ICS-Advisories

Risk Evaluation

Nozomi reported eight vulnerabilities to WAGO affecting different firmwares installed on several devices.

Zusammenfassung der Gegenmaßnahmen

Update to Firmware 4.6.1 (FW28) or for CC100 devices to 4.6.3 (FW28). For G1 devices update to Firmware 3.10.11 (FW22 Patch 2). For the latest Custom Firmware, please contact the WAGO support.

Risk Evaluation

PAS4000 is the software platform for the Automation System PSS 4000. PAS 4000 does not properly check pathnames contained in archives. An attacker can utilise this vulnerability to write arbitrary files, potentially leading to code execution.

Zusammenfassung der Gegenmaßnahmen

Install the fixed version as soon as it is available. Please visit the Pilz Shop (www.pilz.com/en-INT/eshop) to check for the fixed version

Risk Evaluation

Several Pilz products use the 3rd-party component 'libwebp' for decoding of images in WebP format. This component is affected by a vulnerability, which may enable an attacker to gain full control over the system running the software product. Depending on the affected product, the vulnerabilities can be exploited locally or over the network.

Zusammenfassung der Gegenmaßnahmen

Install the fixed product version as soon as it is available. Please visit the Pilz eShop(https://www.pilz.com/en-INT/eshop) to check for the fixed version. PASvisu Runtime: Limit network access to legitimate connections by using a firewall or similarmeasures. Restrict administrative access by setting up user authentication properly.

Risk Evaluation

Several Pilz products use the 3rd party component "CodeMeter Runtime" from WIBU-SYSTEM AG to manage software licenses. This component is affected by a vulnerability, which may enable an attacker to gain full control over the system running the software product. The vulnerability can be exploited locally or over the network. Update A, 2023-12-05 changed affected version of "Software PASvisu < 1.15.0" to "Software PASvisu < 1.14.1" removed CVE-2023-4701 because it was revoked.

Zusammenfassung der Gegenmaßnahmen

PAS4000, PASvisu, PIT User Authentication Service, PNOZsigma Configurator, PMIv8: Installthe fixed version as soon as it is available. Please visit the Pilz eShop(https://www.pilz.com/en-INT/eshop) to check for the fixed version. PASloto, Live Video Server, SafetyEYE Configurator, PMC programming tool: These productsare end-of-live, please follow the general countermeasures.

Risk Evaluation

Critical vulnerabilities have been discovered in the utilized Bluetooth component. For more information see: https://kb.cert.org/vuls/id/799380

Zusammenfassung der Gegenmaßnahmen

The device will play a confirmation sound when a Bluetooth connection is successfully established and a status LED labeled BT indicates that a Bluetooth connection is active. This can be used to detect an unauthenticated connection.

Risk Evaluation

PACTware passwords are stored in a recoverable format (CVE-2020-9403) PACTware passwords may be modified without knowing the current password (CVE-2020-9404)

Zusammenfassung der Gegenmaßnahmen

Any further changes in 'user role'-administration will need a confirmation by using the current login password. This will be fixed in following versions (and higher): PACTware 5.0.5.31 PACTware 4.1 SP6 Overview about version history: https://pactware.com/de/service You can protect yourself against manipulation by restricting the access to the PC where PACTware is installed. In case of not known passwords it can be reset by reinstallation of PACTware (all PACTware versions).

Risk Evaluation

Several critical vulnerabilities within firmware.

Zusammenfassung der Gegenmaßnahmen

For vulnerability CVE-2020-12502 'Cross-Site Request Forgery (CSRF)', CVE-2020- 12503 'Multiple Authenticated Command Injections' and CVE-2020-12504 'Active TFTP- Service' 1. Update following products to the respective Firmware Version: | Product ID | Firmware Version | |------------------------------|-------------------| | ICRL-M-8RJ45/4SFP-G-DIN | 1.4.0 | | ICRL-M-16RJ45/4CP-G-DIN | 1.4.0 | 2. Deactivate TFTP-Service

Risk Evaluation

Critical vulnerabilities have been discovered in the utilized component log4net by Apache Software Foundation. UPDATE A: Remediation: added fixed VisuNet Products

Zusammenfassung der Gegenmaßnahmen

External countermeasures are needed for the remaining products. The following protective measure is required for VisuNet devices and the PCs/Servers with an installed DTM: Restrict local access to the device, PC/Server and use user authentication to prevent unauthorized access.

Risk Evaluation

An unauthenticated attacker could repeatedly send IPv6 packets, that include specially crafted packets, to a Windows machine which could enable remote code execution.

Zusammenfassung der Gegenmaßnahmen

Please install:<br>RM Shell 5 based on Windows 10 LTSB 2016: 18-33624T Windows Cumulative Security Patch - 2024-08 for RM Image 5 based on Windows 10 LTSB 2016 (KB5041773) found at Thin Client Firmware VisuNet RM Shell 5 (2016 LTSB) (pepperl-fuchs.com).

Risk Evaluation

Multiple issues have been found. Please check the CVEs for details.

Zusammenfassung der Gegenmaßnahmen

For all potential vulnerabilities, customers can download a patched firmware to secure their switches properly. Please download and install the latest firmware for your switch by following the procedure below: Use the link www.weidmueller.com external link external link Enter within search field on the web page the product number of the switch you want to update and press 'enter' On next page expand the drop-down menu 'show downloads' Download the respective firmware from the download table Install the firmware on your switch Solution for CVE-2019-16672 a.) Solution for vulnerability, valid for switch series IE-SW-VL05M and IE-SW-VL08MT To avoid the vulnerabilities referred to in this section, it is necessary to install patched firmware. After installation of patched firmware the web interface can be accessed via encrypted communication using https, and web interface access can be configured to ensure encrypted connections by selecting 'https only'. The respective web interface menu section for this setting can be reached via the following path: Main Menu > Basic Settings > System: Set the 'Web Configuration' to 'https only' b.) Solution for vulnerability, valid for switch series IE-SW-PL08M, IE-SW-PL10M, IE-SW-PL16M, IE-SW-PL18M, IE-SW-PL09M To avoid the vulnerabilities referred to in this section, installation of patched firmware is not necessary. Web interface access can be configured to ensure encrypted connections by selecting 'https only'. The respective web interface menu section for this setting can be reached via the following path: Main Menu > Basic Settings > System: Set the 'Web Configuration' to 'https only' Solution for CVE-2019-16670, CVE-2019-16671, CVE-2019-16673, CVE-2019-16674 Solution for vulnerabilities, valid for switch series IE-SW-VL05M, IE-SW-VL08MT, IE-SW-PL08M, IE-SW-PL10M, IE-SW-PL16M, IE-SW-PL18M, IE-SW-PL09M After installing the patched firmware on the switch, it is possible to disable the unencrypted search service via Weidmüllermüller configuration software named 'WM Switch Utility' for Windows OS and to enable an encrypted search service, that will be working with the new 'Weidmüllermüller Switch Configuration Utility'. (available soon) Both services – the encrypted and the unencrypted search service - are enabled by default. To avoid the vulnerabilities referred to in this section the unencrypted search service should be disabled. The respective web interface menu section for this setting can be reached via the following path: Main Menu > Basic Settings > Security > Management Interface: Uncheck the checkbox 'Enable Search Service' Note: After disabling the unencrypted search service the switches can no longer be found or configured with the current 'WM Switch Utility'! Web interface settings are not affected by this configuration. --- Please find below the appropriate patched firmware versions for all affected products. | **Product Number** | **Product Name** | **Patched Firmware Version** | |---------------------|---------------------------------|---------------------------------------| | 1504280000 | IE-SW-VL05M-5TX | ≥ V3.6.24_Build_19062809 | | 1504310000 | IE-SW-VL05MT-5TX | ≥ V3.6.24_Build_19062809 | | 1504330000 | IE-SW-VL05M-3TX-2SC | ≥ V3.6.24_Build_19062809 | | 1504350000 | IE-SW-VL05MT-3TX-2SC | ≥ V3.6.24_Build_19062809 | | 1504370000 | IE-SW-VL05M-3TX-2ST | ≥ V3.6.24_Build_19062809 | | 1504390000 | IE-SW-VL05MT-3TX-2ST | ≥ V3.6.24_Build_19062809 | | 1240940000 | IE-SW-VL08MT-8TX | ≥ V3.5.22_Build_19062810 | | 1240970000 | IE-SW-VL08MT-5TX-3SC | ≥ V3.5.22_Build_19062810 | | 1345240000 | IE-SW-VL08MT-5TX-1SC-2SCS | ≥ V3.5.22_Build_19062810 | | 1240990000 | IE-SW-VL08MT-6TX-2ST | ≥ V3.5.22_Build_19062810 | | 1344770000 | IE-SW-VL08MT-6TX-2SC | ≥ V3.5.22_Build_19062810 | | 1241020000 | IE-SW-VL08MT-6TX-2SCS | ≥ V3.5.22_Build_19062810 | | 1241040000 | IE-SW-PL08M-8TX | ≥ V3.3.16_Build_19062811 | | 1286780000 | IE-SW-PL08MT-8TX | ≥ V3.3.16_Build_19062811 | | 1241070000 | IE-SW-PL08M-6TX-2SC | ≥ V3.3.16_Build_19062811 | | 1286790000 | IE-SW-PL08MT-6TX-2SC | ≥ V3.3.16_Build_19062811 | | 1241080000 | IE-SW-PL08M-6TX-2ST | ≥ V3.3.16_Build_19062811 | | 1286800000 | IE-SW-PL08MT-6TX-2ST | ≥ V3.3.16_Build_19062811 | | 1241090000 | IE-SW-PL08M-6TX-2SCS | ≥ V3.3.16_Build_19062811 | | 1286810000 | IE-SW-PL08MT-6TX-2SCS | ≥ V3.3.16_Build_19062811 | | 1241290000 | IE-SW-PL10M-3GT-7TX | ≥ V3.3.24_Build_19062813 | | 1286930000 | IE-SW-PL10MT-3GT-7TX | ≥ V3.3.24_Build_19062813 | | 1241300000 | IE-SW-PL10M-1GT-2GS-7TX | ≥ V3.3.24_Build_19062813 | | 1286940000 | IE-SW-PL10MT-1GT-2GS-7TX | ≥ V3.3.24_Build_19062813 | | 1241100000 | IE-SW-PL16M-16TX | ≥ V3.4.18_Build_19062814 | | 1286820000 | IE-SW-PL16MT-16TX | ≥ V3.4.18_Build_19062814 | | 1241120000 | IE-SW-PL16M-14TX-2SC | ≥ V3.4.18_Build_19062814 | | 1286830000 | IE-SW-PL16MT-14TX-2SC | ≥ V3.4.18_Build_19062814 | | 1241130000 | IE-SW-PL16M-14TX-2ST | ≥ V3.4.18_Build_19062814 | | 1286840000 | IE-SW-PL16MT-14TX-2ST | ≥ V3.4.18_Build_19062814 | | 1241320000 | IE-SW-PL18M-2GC-16TX | ≥ V3.4.30_Build_19062817 | | 1286970000 | IE-SW-PL18MT-2GC-16TX | ≥ V3.4.30_Build_19062817 | | 1241330000 | IE-SW-PL18M-2GC14TX2SC | ≥ V3.4.30_Build_19062817 | | 1286990000 | IE-SW-PL18MT-2GC14TX2SC | ≥ V3.4.30_Build_19062817 | | 1241340000 | IE-SW-PL18M-2GC14TX2ST | ≥ V3.4.30_Build_19062817 | | 1287000000 | IE-SW-PL18MT-2GC14TX2ST | ≥ V3.4.30_Build_19062817 | | 1241350000 | IE-SW-PL18M-2GC14TX2SCS | ≥ V3.4.30_Build_19062817 | | 1287010000 | IE-SW-PL18MT-2GC14TX2SCS | ≥ V3.4.30_Build_19062817 | | 1241370000 | IE-SW-PL09M-5GC-4GT | ≥ V3.3.20_Build_19070111 | | 1287020000 | IE-SW-PL09MT-5GC-4GT | ≥ V3.3.20_Build_19070111 |

Risk Evaluation

Multiple Weidmueller products are affected by recent WIBU vulnerability.

Zusammenfassung der Gegenmaßnahmen

u-create studio: Disabling the network server function within CodeMeter would mitigate the vulnerability. To disable this function please refer to the following steps: 1. Navigate to the CodeMeter WebAdmin Website 2. Select option Settings > Server > Server access 3. Choose option 'deactivate' in section 'network server' 4. Click 'Apply' button on the bottom of the website

Risk Evaluation

Several vulnerabilities have been identified in the web-based management of WAGO devices utilized in Endress+Hauser IoT solutions. WAGO has provided fixes for these vulnerabilities, which have been integrated into the solutions by Endress+Hauser. Additionally, a guideline on secure operation of these solutions has been made available.

Zusammenfassung der Gegenmaßnahmen

If an immediate firmware update is not possible, the only way to prevent an attack is to prevent the access of the Web Based Management tool from the internet. This can be achieved by using a network element, such as a router, which hides and secures the components from the internet.

Risk Evaluation

Beckhoff's TwinCAT RT network driver for Intel 8254x and 8255x is providing EtherCAT functionality. The driver implements real-time features. Except for Ethernet frames sent from real-time functionality, all other Ethernet frames sent through the driver are not padded if their payload is less than the minimum Ethernet frame size. Instead, arbitrary memory content is transmitted within in the padding bytes of the frame. Most likely this memory contains slices from previously transmitted or received frames.

Zusammenfassung der Gegenmaßnahmen

Beckhoff offers software patches for TwinCAT 3.1 and TwinCAT 2.11 on request. These patches will be included in the the next regular releases to the affected software versions. The advisory will be updated upon availability.

Risk Evaluation

The affected products can act as OPC UA client or server and are vulnerable to two different kind of attacks via the OPC UA protocol. For both cases the attacker can send packets via the OPC UA protocol without the need to authenticate and 1. provoke a stack overflow resulting in denial of service of the product or 2. make the product disclose information to the attacker without authorization.

Zusammenfassung der Gegenmaßnahmen

Consider limiting access to the network communication ports of affected server products. Also consider limiting where the affected client products are allowed to connect to. For example, this can be achived with Windows' built-in firewall by incoming rules for servers and outgoing rules for clients. Consider to minimize the ability of an attacker to hijack communication establishment from a client to a server. For example this can be achieved with the help of zones and conduits: Try to keep servers and clients within the same network zone and prevent intrusion into that zone. Try to enclose communication establishment within conduits like VPN channels (where one conduit can serve for many OPC UA connections) and prevent attackers from intruding into such channels. Consider updating the .NET Framework.

Risk Evaluation

The default installation path and its permissions for the TwinCAT runtime allow a local user to replace or modify executables other users of the same system might execute. The issue does not apply for installations underneath C:\Program Files.

Zusammenfassung der Gegenmaßnahmen

Please consider the solution described with the next section (title 'Solution') for new installations only and installations for which it is acceptable to reinstall TwinCAT. For existing installations a script is provided for download at the following link: https://download.beckhoff.com/download/Document/product-security/Advisories/advisory-2020-003/cve-2020-12510.zip external link It changes the permissions of a directory of an already installed TwinCAT 3.1 installation. More precisely, it reads the current permissions of 'C:\Program Files' and copies them to the directory '3.1\System' underneath the installation path of TwinCAT (default 'C:\TwinCAT\3.1\System'). The procedure to use that script is as follows: 1. Download the script, unzip it, and copy it to the IPC. 2. On the IPC log in as administrator and open a PowerShell (Windows-Key + R + 'PowerShell'). 3. At the PowerShell enter the following command to temporarily allow the execution of scripts: set-executionpolicy -ExecutionPolicy Unrestricted -Scope Process (The effect of this is limited to the life-time of the current shell window because of '-Scope Process'.) 4. Then change to the path to where you downloaded the script and execute it: .\cve-2020-12510.ps1 The expected output is 'Copied the permissions from C:\Program Files to \3.1\System'. 5. Close the PowerShell and log out from the IPC as needed. It is safe to apply the script several times. It is safe to run it during full operation of TwinCAT XAR 3.1. There is no need to reboot the IPC afterwards. There is no need to periodically run the script. Future updates of TwinCAT 3.1 will either not touch the permissions which are set by the script or apply more appropriate ones. To apply the procedure to a set of IPCs you can prepare a USB stick with the content of the ZIP file 'cve-2020- 12510.zip' (see download URL above). Then the procedure for each IPC is: 1. Log in as administrator on the IPC. 2. Open the USB stick with the File Explorer (formerly known as Windows Explorer). 3. Double click on the file 'run-cve-2020-12510.bat'. (This simply invokes the PowerShell to execute the script already described above.)

Risk Evaluation

By default, TwinCAT/BSD-based products have a device-specific web interface for web-based management (WBM) enabled, developed by Beckhoff and known as Beckhoff Device Manager UI. It can be accessed remotely or locally. When accessed locally, the user can bypass input validation by entering specially crafted inputs into the user interface for certain pages, which then allows local commands to be executed with administrative privileges.

Zusammenfassung der Gegenmaßnahmen

Avoid the existence of user accounts with login permission on the target other than administrator access. By default, TwinCAT/BSD has preconfigured user accounts with lower privileges, but none of them have a password, which results in them being denied login access. Avoid running third-party applications on the target that have not been properly audited, regardless of the user they are running as.

Risk Evaluation

Through specific nodes of the server configuration interface of the TwinCAT OPC UA Server administrators are able to remotely create and delete any files on the system which the server is running on, though this access should have been restricted to specific directories. In case that configuration interface is combined with not recommended settings to allow anonymous access via the TwinCAT OPC UA Server then this kind of file access is even possible for any unauthenticated user from remote.

Zusammenfassung der Gegenmaßnahmen

Consider restricting access to the nodes of the 'TcOpcUAServer' with the methods described by https://infosys.beckhoff.com/content/1033/tcopcuaserver/5930038411-1.html such that the administrative interface can only be accessed by administrative users of well known OPC UA clients.

Risk Evaluation

By default, TwinCAT/BSD-based products have a device-specific web interface for web-based management (WBM) enabled, developed by Beckhoff and known as Beckhoff Device Manager UI. It can be accessed remotely or locally. When accessed locally, a user can post specifically crafted input which then causes a buffer overflow on stack which in turn lets the process 'MDPService' crash such that the web interface becomes unavailable until next restart or even execute code in the context of user 'root'.

Zusammenfassung der Gegenmaßnahmen

Avoid the existence of user accounts with login permission on the target other than administrator access. By default, TwinCAT/BSD has preconfigured user accounts with lower privileges, but none of them have a password, which results in them being denied login access. Avoid running third-party applications on the target that have not been properly audited, regardless of the user they are running as.

Risk Evaluation

The coupler's function could be inhibited by an attack.

Zusammenfassung der Gegenmaßnahmen

Beckhoff will not change this behaviour. Customers should configure a perimeter firewall to block traffic from untrusted networks to the device.

Risk Evaluation

By default, TwinCAT/BSD-based products have a device-specific web interface for web-based management (WBM) enabled, developed by Beckhoff and known as Beckhoff Device Manager UI. It can be accessed remotely or locally. When accessed locally, the authentication mechanism for the web interface can be bypassed by any local user, regardless of their permissions, and they can act with administrative access rights via this mechanism.

Zusammenfassung der Gegenmaßnahmen

Avoid the existence of user accounts with login permission on the target other than administrator access. By default, TwinCAT/BSD has preconfigured user accounts with lower privileges, but none of them have a password, which results in them being denied login access. Avoid running third-party applications on the target that have not been properly audited, regardless of the user they are running as.

Risk Evaluation

With TwinCAT/BSD based products the HTTPS request to the Authelia login page accepts user-controlled input that specifies a link to an external site.

Zusammenfassung der Gegenmaßnahmen

Use firewall or web-proxy technology at your network perimeter which allow internal clients to access only trusted external sites directly.

Risk Evaluation

By default, TwinCAT/BSD-based products have a device-specific web interface for web-based management (WBM) enabled, developed by Beckhoff and known as Beckhoff Device Manager UI. It can be accessed remotely or locally. When accessed locally, a user can post specifically crafted input which then lets the process 'MDPWebServer' consume a maximum of CPU cycles and Random Access Memory (RAM).

Zusammenfassung der Gegenmaßnahmen

Avoid the existence of user accounts with login permission on the target other than administrator access. By default, TwinCAT/BSD has preconfigured user accounts with lower privileges, but none of them have a password, which results in them being denied login access. Avoid running third-party applications on the target that have not been properly audited, regardless of the user they are running as.

Risk Evaluation

The TRUMPF products that are listed above contain a vulnerable version of Notepad++. This version isbeing installed for support purposes only, so there is no danger of triggering this vulnerability inNotepad++ during normal operations. Nevertheless, TRUMPF recommends mitigation of thisvulnerability.When editing a specially crafted file containing UTF-8 characters in Notepad++ (Versions up to 8.5.6) and converting that file to UTF-16, a buffer overflow vulnerability can be exploited that allows an attacker to execute arbitrary code to take over the whole system.

Zusammenfassung der Gegenmaßnahmen

For additional questions please contact your TRUMPF Service with the PR number 501709.

Risk Evaluation

The versions of TRUMPF products stated below are including a version of log4net that's prone to XXE (External XML Entities) attacks under certain circumstances. This means, the log4net code can be tricked into loading externally hosted, potentially malicious XML code and possibly executing it. This vulnerability allows for the execution of remote XML code, possibly resulting in unauthorized (remote) access to, change of data or disruption of the whole system running the vulnerable application.

Zusammenfassung der Gegenmaßnahmen

New versions are available for the affected products. Install new versions as provided by TRUMPF SE + Co. KG. To aquire these versions please contact your TRUMPF Service with the PR number 500879.

Risk Evaluation

TruControl laser control software from versions 1.60.0 to 3.40.0 use a vulnerable  X.Org server versions. The affected X.Org vulnerability is not validating the request length properly for the handler 'ProcXkbSetGeometry'. An authenticated Attacker could craft a request which could lead to memory out-of bounds write.

Zusammenfassung der Gegenmaßnahmen

Securing the access to the production network. Please contact your service partner (service.tls@trumpf.com) for instructions on how to get automatically informed for the new major release 3.42.0 of the new TruControl software version.