ICS Advisories

Risk evaluation

A vulnerability in the iDTM FDI allows an attacker with elevated privileges and access to the host system to enable the debug interface by placing a crafted file in the application directory.

Mitigation summary

If an immediate update is not possible, Endress+Hauser recommends the following measures to reduce the risk of exploitation: * Restrict access to affected systems to authorized personnel only * Apply the principle of least privilege and limit administrative access to trusted users. * Protect application installation directories against unauthorized modification through appropriate operating system access controls. Following these recommendations reduces the risk of unauthorized activation.

Risk evaluation

A vulnerability was discovered in several Endress+Hauser products that can be accessed via ethernet.

Mitigation summary

Restrict device access to trusted and authorized entities only. Apply the general security measures during product operation to mitigate the identified security risk. Refer to the ICS‑CERT Recommended Practices for Industrial Security for additional guidance.

Risk evaluation

The display unit of the Endress+Hauser MCS200HW is affected by a sudo chroot vulnerability.

Mitigation summary

The display unit's firmware versions below 4.3.4 are affected. To address the vulnerability, customers are strongly recommended to update the display unit of their devices to firmware version 4.3.4. Endress+Hauser will include this firmware version in the MCS200HW products starting with version 1.11.5.6R. Alternatively, customers can contact Endress+Hauser directly to obtain the updated display firmware, or download the original firmware - including update instructions - from the Phoenix Contact website referenced below.

Risk evaluation

Multiple vulnerabilities in a Qualcomm component have been reported in a closed-source report. This component is an integral part of the radio chip found in several Endress+Hauser products.

Mitigation summary

If a firmware update is no longer possible, it is recommended to replace the device.

Risk evaluation

Multiple Endress+Hauser devices are prone to vulnerabilities found in e!Runtime and the CODESYS V3 framework.

Mitigation summary

The CDC 90 device is not designed for network connectivity by default. Since it is not connected to a network, the vulnerabilities cannot be exploited. However, if the customer chooses to connect the device to a network, the default firewall settings should be maintained, as this will mitigate the security vulnerabilities. For the CC 100 and PFC 200 devices, ensure that the default firewall settings remain intact and that both PLC Runtime and PLC WebVisu are disabled. This configuration effectively mitigates the identified security vulnerabilities.

Risk evaluation

A vulnerability has been identified in WAGO devices utilized in Endress+Hauser IoT solutions. WAGO has provided fixes for these vulnerabilities, which have been integrated into the solutions by Endress+Hauser.

Mitigation summary

Local access is required to exploit this vulnerability. To mitigate the risk, ensure that only authorized personnel have physical access to the device.

Risk evaluation

A privilege escalation vulnerability has been identified in Endress+Hauser's Proline 10 devices. This flaw allows an authenticated user with Operator-level access to elevate their privileges and gain Maintenance-level access, potentially enabling unauthorized configuration changes. Endress+Hauser has released a security update addressing this issue.

Mitigation summary

If an immediate firmware update is not feasible, it is recommended to disable the device's Bluetooth communication when not actively in use. This significantly reduces the risk of unauthorized access by eliminating the key vector through which the vulnerability could be exploited.

Risk evaluation

A vulnerability in Wibu-Systems CodeMeter (up to version 7.60b) affects multiple Endress+Hauser products. This flaw can lead to a heap buffer overflow, which may allow remote code execution under certain conditions.

Mitigation summary

If possible, configure CodeMeter to run in client-only mode. If server mode is required, restrict access to authorized clients by implementing an access control list. For Proline Promag 800 OPC UA Connectivity, CodeMeter operates as a server only during license activation. Installation and license activation are managed by Endress+Hauser. If a customer performs manual license activation, it is strongly recommended to limit network access to necessary clients only by using firewalls or equivalent security measures.

Risk evaluation

Several vulnerabilities have been identified in the web-based management of WAGO devices utilized in Endress+Hauser IoT solutions. WAGO has provided fixes for these vulnerabilities, which have been integrated into the solutions by Endress+Hauser. Additionally, a guideline on secure operation of these solutions has been made available.

Mitigation summary

If an immediate firmware update is not possible, the only way to prevent an attack is to prevent the access of the Web Based Management tool from the internet. This can be achieved by using a network element, such as a router, which hides and secures the components from the internet.

Risk evaluation

The fdtCONTAINER component is integrated into an application (host application). The fdtCONTAINER application is a specific host application which integrates the fdtCONTAINER component. The fdtCONTAINER component exchanges binary data blobs with such a host application. Typically, the host application saves these binary data blobs into a project storage (project file or a project database). To manipulate the data inside the project storage, the attacker needs write access to this project storage. Additionally, the manipulated project needs to be opened by the host application. It depends on the host application whether opening the project requires a user action or not. In fdtCONTAINER applications, the user has to open the manipulated project file manually. In the case of opening a stored project, the deserialization of the manipulated data can be exploited.

Mitigation summary

1. Exchange project data only via secure exchange services 2. Use appropriate means to protect the project storage from unauthorized manipulation 3. Do not open project data from an unknown source 4. Reduce the user rights of the host application to the necessary minimum

Risk evaluation

The firmware release has a dynamic token for each request submitted to the server, which makes repeating requests and analysis complex enough. Nevertheless, it's possible and during the analysis it was discovered that it also has an issue with the access-control matrix on the server-side.

Mitigation summary

Customers should configure a perimeter firewall to block traffic from untrusted networks and users to the device. These recommendations will be incorporated into the device documentation (operating instructions) Change default password for operator, service and admin account. Endress+Hauser will not change this behavior. Customers are recommended to take the measures for Temporary Fix / Mitigation as described above.

Risk evaluation

Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.

Mitigation summary

Make sure that no unauthorized access to the production environment is possible. Avoid using the above listed software with Windows administrator privileges if other users with lower privileges have access to the same software installation.

Risk evaluation

For further Information please refer to WIBU Advisories directly at https://wibu.com/support/security-advisories.html and the aforementioned CVE-IDs.

Mitigation summary

WIBU SYSTEMS has released a new Code Meter Runtime version 7.10a dated on 16.9.2020. All the known vulnerabilities are fixed with this version. The version is available at https://www.wibu.com/support

Risk evaluation

Promass 83 devices utilizing 499ES EtherNet/IP (ENIP) Stack by Real Time Automation (RTA) are vulnerable to a stack-based buffer overflow. Update A, 2021-10-07: added credits changed title from "ENDRESS+HAUSER: Promass 83 with Ether/IP affected by DoS vulnerability" to "ENDRESS+HAUSER: Promass 83 with EtherNet/IP affected by a stack-based buffer overflow"

Mitigation summary

If an immediate firmware update is not possible, the only way to prevent an attack is to disable communication via EtherNet/IP.

Risk evaluation

Endress+Hauser products utilizing WPA2 are vulnerable to KRACK attacks. Proline portfolio is a flow meter with an optional WLAN interface in the display. The flowmeters are only affected if the optional WLAN display is present.

Mitigation summary

If an immediate firmware update is not possible, the WLAN on the unit can also be switched off as a precautionary measure.

Risk evaluation

The affected device has a web-based user interface with a role-based access system. Users with different roles have different write and read privileges. The access system is based on dynamic "tokens".

Mitigation summary

Customers should configure a perimeter firewall to block traffic from untrusted networks and users to the device. These recommendations will be incorporated into the device documentation (operating instructions). Change default password for operator, service and admin account. Endress+Hauser will not change this behavior. Customers are recommended to take the measures for Temporary Fix / Mitigation as described above.

Risk evaluation

Several vulnerabilities in the Endress+Hauser MEAC300-FNADE4 were discovered, that can be accessed via Ethernet.

Mitigation summary

Customers are strongly advised to update to the newest version.

Risk evaluation

Echo Curve Viewer is an utility used for offline visualization of previously recorded envelope curve data. Envelope curve records are exported from other Endress+Hauser software products like FieldCare as .curves files. Echo Curve Viewer opens .curves files and displays their contents. The .curves files contain device- specific C# calculation scripts as .cs files, that are needed for the interpretation of certain curve record types. Echo Curve Viewer loads .curves files and executes the contained C# code.

Mitigation summary

- For standalone Echo Curve Viewer installations, download and install Echo Curve Viewer version >=6.00.00 from the Endress+Hauser Software Portal - For bundled installations with FieldCare SFE500, download and install FieldCare SFE500 Package version >= 1.40.1 from the Endress+Hauser Software Portal external link - For Field Xpert Devices, the required update is installed automatically during startup. This requires a working internet connection and (under certain circumstances) a valid maintenance period and/or a connection to the E+H Netilion Cloud. Please refer to the Field Xpert documentation for details regarding the update mechanism.

Risk evaluation

For detailed information please refer to WIBU SYSTEMS original Advisories at https://wibu.com/support/security-advisories.html.

Mitigation summary

All vulnerabilities have already been fixed in several CodeMeter versions. Endress+Hauser recommends to use CodeMeter version >=7.40b. The version is available at https://www.wibu.com/support. For the Operating System WIN 7 it's recommended to update the operating system, use/re-install the Endress+Hauser Software Application supporting the newer operating system and update Code Meter to version >= 7.40b.

Risk evaluation

Possible memory corruption in BT controller when it receives an oversized LMP packet over 2-DH1 link and leads to denial of service.

Mitigation summary

Endress+Hauser recommends using the FieldPort SFP50 only in secure environment and to allow access tothe devices only to authorized persons.