Industrial automation solutions provider MDT Software has patched several critical and high-severity vulnerabilities in its flagship product, MDT AutoSave.
MDT AutoSave is an automation change management solution that provides backup, version control, historical tracking, user permission, audit trail, change detection, and disaster recovery capabilities for a wider range of industrial control systems (ICS), including PLC, CNC, SCADA, HMI, robots, drives, and welders.
The product is used by some of the world’s biggest manufacturers, including major car makers (Tesla, Kia, BMW, Hyundai, Honda), Coca Cola, P&G, Johnson & Johnson, AstraZeneca, and Nestlé Purina.
Researchers at industrial cybersecurity firm Claroty discovered that MDT AutoSave is affected by seven types of vulnerabilities, including two rated critical and five rated high severity.
Sharon Brizinov, who leads the Vulnerability Research Team at Claroty, told SecurityWeek that an attacker needs network access to the MDT AutoSave server in order to exploit the vulnerabilities.
According to an advisory published last week by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), one of the critical vulnerabilities, CVE-2021-32953, can be exploited to create a new user in the system by using SQL commands, and update that user’s permissions, which allows the attacker to log into the system.
Learn More About Vulnerabilities in Industrial Products at SecurityWeek’s ICS Cyber Security Conference and SecurityWeek’s Security Summits Virtual Event Series
The second critical flaw, CVE-2021-32933, has been described as a command injection issue and it can be exploited to run a malicious process.
“[CVE-2021-32933] could have enabled an attacker to leverage an API to pass along a malicious file, which could then manipulate the process creation command line and run a command line argument. This could then be leveraged to run a malicious process without any authentication required,” Brizinov explained.
According to CISA, the high-severity vulnerabilities can allow an attacker to break encryption and gain access to the system, replace legitimate files with malicious files, execute malicious files, and obtain sensitive information.
The flaws affect MDT AutoSave versions 6.x and 7.x, and AutoSave for System Platform (A4SP) versions 4 (and earlier) and 5.0. The vendor released patches for each of the impacted products at different times between December 2020 and June 2021.
Related: ICS Patch Tuesday: Siemens and Schneider Electric Address 100 Vulnerabilities
Related: ICS Vendors Assessing Impact of New OPC UA Vulnerabilities
Related: Vulnerabilities in B&R Automation Software Facilitate Attacks on ICS Networks
Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Sony Investigating After Hackers Offer to Sell Stolen Data
- 900 US Schools Impacted by MOVEit Hack at National Student Clearinghouse
- Predator Spyware Delivered to iOS, Android Devices via Zero-Days, MitM Attacks
- China’s Offensive Cyber Operations in Africa Support Soft Power Efforts
- SANS Survey Shows Drop in 2023 ICS/OT Security Budgets
- Apple Patches 3 Zero-Days Likely Exploited by Spyware Vendor to Hack iPhones
- Cisco to Acquire Splunk for $28 Billion
- Car Cybersecurity Study Shows Drop in Critical Vulnerabilities Over Past Decade
Latest News
- UAE-Linked APT Targets Middle East Government With New ‘Deadglyph’ Backdoor
- Sony Investigating After Hackers Offer to Sell Stolen Data
- The CISO Carousel and its Effect on Enterprise Cybersecurity
- Xenomorph Android Banking Trojan Targeting Users in US, Canada
- $200 Million in Cryptocurrency Stolen in Mixin Network Hack
- Stealthy APT Gelsemium Seen Targeting Southeast Asian Government
- Nigerian Pleads Guilty in US to Million-Dollar BEC Scheme Role
- 900 US Schools Impacted by MOVEit Hack at National Student Clearinghouse
