Researchers Uncover Main Safety Vulnerabilities in Industrial MMS Protocol Libraries -Tech Cyber Internet

Oct 09, 2024Ravie LakshmananIndustrial Safety / Important Infrastructure

Particulars have emerged about a number of safety vulnerabilities in two implementations of the Manufacturing Message Specification (MMS) protocol that, if efficiently exploited, might have extreme impacts in industrial environments.

“The vulnerabilities might enable an attacker to crash an industrial system or in some circumstances, allow distant code execution,” Claroty researchers Mashav Sapir and Vera Mens mentioned in a brand new evaluation.

MMS is an OSI software layer messaging protocol that allows distant management and monitoring of commercial units by exchanging supervisory management info in an application-agnostic method.

Particularly, it permits for communication between clever digital units (IEDs) and supervisory management and knowledge acquisition (SCADA) techniques or programmable logic controllers (PLCs).

The 5 shortcomings recognized by the operational expertise safety firm influence MZ Automation’s libIEC61850 library and Triangle MicroWorks’ TMW IEC 61850 library, and had been patched in September and October 2022 following accountable disclosure –

• CVE-2022-2970 (CVSS rating: 10.0) – A stack-based buffer overflow vulnerability in libIEC61850 that might result in a crash or distant code execution

• CVE-2022-2971 (CVSS rating: 8.6) – A sort confusion vulnerability in libIEC61850 that might enable an attacker to crash the server with a malicious payload

• CVE-2022-2972 (CVSS rating: 10.0) – A stack-based buffer overflow vulnerability in libIEC61850 that might result in a crash or distant code execution

• CVE-2022-2973 (CVSS rating: 8.6) – A null pointer deference vulnerability that might enable an attacker to crash the server

• CVE-2022-38138 (CVSS rating:7.5) – An entry of uninitialized pointer vulnerability that enables an attacker to trigger a denial-of-service (DoS) situation

Claroty’s evaluation additionally discovered that Siemens SIPROTEC 5 IED relied on an outdated model of SISCO’s MMS-EASE stack for MMS help, which is vulnerable to a DoS situation through a specifically crafted packet (CVE-2015-6574CVSS rating: 7.5).

The German firm has since up to date its firmware with an up to date model of the protocol stack as of December 2022, based on an advisory launched by the U.S. Cybersecurity and Infrastructure Safety Company (CISA).

The analysis highlights the “hole between fashionable expertise’s safety calls for and the outdated, hard-to-replace protocols,” Claroty mentioned, urging distributors to comply with safety pointers issued by CISA.

The disclosure comes weeks after Nozomi Networks detailed two vulnerabilities within the reference implementation of Espressif’s ESP-NOW wi-fi protocol (CVE-2024-42483 and CVE-2024-42484) that might enable replay assaults and trigger a DoS situation.

“Relying on the system being focused, this vulnerability [CVE-2024-42483] can have profound penalties,” it mentioned. “ESP-NOW is utilized in safety techniques reminiscent of constructing alarms, permitting them to speak with movement sensors.”

“In such a state of affairs, an attacker might exploit this vulnerability to replay a beforehand intercepted professional ‘OFF’ command, thereby disabling a movement sensor at will.”

Alternatively, ESP-NOW’s use in distant door openers, reminiscent of computerized gates and storage doorways, may very well be weaponized to intercept an “OPEN” command and replay it at a later time to achieve unauthorized entry to buildings.

Again in August, Nozomi Networks additionally make clear a set of unpatched 37 vulnerabilities within the OpenFlow libfluid_msg parsing library, collectively dubbed FluidFaults, that an adversary might exploit to crash Software program-Outlined Networking (SDN) functions.

“An attacker with community visibility to an OpenFlow controller/forwarder can ship a malicious OpenFlow community packet that results in a denial-of-service (DoS) assault,” the corporate mentioned.

In current months, safety flaws have additionally been uncovered in Beckhoff Automation’s TwinCAT/BSD working system that might expose PLCs to logic tampering, DoS assaults, and even command execution with root privileges on the controller.