ICS Advisories

Risk evaluation

ABB is aware of publicly reported information concerning recently disclosed PHP vulnerabilities that impact the product versions listed as affected in the advisory. An attacker who successfully exploited this vulnerability may insert and run arbitrary code on affected products. As part of ABB product lifecycle policy, once a product transitions to obsolete state, we discontinue maintenance, security patches, and technical support to focus on current and future technologies. While the product will continue to function, we strongly recommend implementing the mitigations de-fined in this document to reduce security risks.

Mitigation summary

Mitigating factors describe conditions and circumstances that make an attack that exploits vulnerability difficult or less likely to succeed. - Obtain a private cellular Access Point (private APN). A dedicated private APN and the corresponding SIM card subscriptions can be obtained from your cellular service provider. This service does not expose traffic between remote sites and the main site to the Internet. Instead, communication is carried over the cellular operator’s private wide area network (WAN). Therefore, the ARM600 does not require any inbound ports to be exposed to the Internet. - Avoid exposing any system component directly to the Internet. If the ARM600 must be exposed to the Internet, only the VPN port should be accessible from the Internet. Patrol management connections can be configured to use a VPN tunnel, and remote administration can be performed using an PC OpenVPN client or another VPN solution that provides mutual authentication. - Establish Demilitarized Zone (DMZ) architecture, where the ARM600 server is deployed in the DMZ to terminate VPN connections from remote sites. The DMZ must be segregated from other networks by a firewall. - Configure the device firewall according to the allowlisting principle (i.e., explicitly allow only the required ports and protocols and block all other traffic). - Change the default user credentials of the ARM600 and Arctic wireless gateways, and use strong, non-guessable passwords that include special characters. Do not reuse passwords within the system.