Industrial automation solutions provider MDT Software has patched several critical and high-severity vulnerabilities in its flagship product, MDT AutoSave.
MDT AutoSave is an automation change management solution that provides backup, version control, historical tracking, user permission, audit trail, change detection, and disaster recovery capabilities for a wider range of industrial control systems (ICS), including PLC, CNC, SCADA, HMI, robots, drives, and welders.
The product is used by some of the world’s biggest manufacturers, including major car makers (Tesla, Kia, BMW, Hyundai, Honda), Coca Cola, P&G, Johnson & Johnson, AstraZeneca, and Nestlé Purina.
Researchers at industrial cybersecurity firm Claroty discovered that MDT AutoSave is affected by seven types of vulnerabilities, including two rated critical and five rated high severity.
Sharon Brizinov, who leads the Vulnerability Research Team at Claroty, told SecurityWeek that an attacker needs network access to the MDT AutoSave server in order to exploit the vulnerabilities.
According to an advisory published last week by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), one of the critical vulnerabilities, CVE-2021-32953, can be exploited to create a new user in the system by using SQL commands, and update that user’s permissions, which allows the attacker to log into the system.
Learn More About Vulnerabilities in Industrial Products at SecurityWeek’s ICS Cyber Security Conference and SecurityWeek’s Security Summits Virtual Event Series
The second critical flaw, CVE-2021-32933, has been described as a command injection issue and it can be exploited to run a malicious process.
“[CVE-2021-32933] could have enabled an attacker to leverage an API to pass along a malicious file, which could then manipulate the process creation command line and run a command line argument. This could then be leveraged to run a malicious process without any authentication required,” Brizinov explained.
According to CISA, the high-severity vulnerabilities can allow an attacker to break encryption and gain access to the system, replace legitimate files with malicious files, execute malicious files, and obtain sensitive information.
The flaws affect MDT AutoSave versions 6.x and 7.x, and AutoSave for System Platform (A4SP) versions 4 (and earlier) and 5.0. The vendor released patches for each of the impacted products at different times between December 2020 and June 2021.
Related: ICS Patch Tuesday: Siemens and Schneider Electric Address 100 Vulnerabilities
Related: ICS Vendors Assessing Impact of New OPC UA Vulnerabilities
Related: Vulnerabilities in B&R Automation Software Facilitate Attacks on ICS Networks
