ICS Advisories

Risk evaluation

The Lenze VPN client is vulnerable to a Remote Code Execution. The vulnerability would allow an attacker to perform a remote code execution on the computer running the client with elevated privileges.

Mitigatiesamenvatting

The Lenze VPN Client is available and downloadable via the Fleet Manager. Please update this Client. Obtain the update software (version >= 1.4.7) from https://cloud.lenze.digital/fleet-manager/tools and run the installer on a windows and macOS system or run the following commands in an linux system: ``` tar -xzf vpn_client_x64.tar.gz cd vpn_client_x64 sudo ./install ```

Risk evaluation

The affected products belong to the Controller or Servo Drive product family and contain a vulnerability in a security-critical activation mechanism for service access. The signature verification of a file used for SSH activation can be compromised, which could allow unauthorized access to the device.

Mitigatiesamenvatting

To resolve this security vulnerability, we recommend installing a firmware update. | Product | Firmware | Fixed Version | | --------------- | -------- | ------------- | | Controller c430 | c4xx | 1.15.2 | | c520 | c5xx | 1.15.2 | | c550 | c5xx | 1.15.2 | | i950 GenA | i950 | 1.15.0 | | i950 GenB | i950 | 2.0.3 |

Risk evaluation

A security vulnerability was discovered in the PLC Designer V4 in the version 4.0.0 where the programmer of a Controller can set a password for the connected device. Here it is possible in an interface of the PLC Designer V4 for the programmer to enter a password for the Device. There is a special constellation where the password entered appears in plain text. Only the display in the tool is affected and not the management of the password on the device. This vulnerability of PLC Designer V4 only occurs in combination with the devices c430 controller, c520 controller and c550 controller and not in combination with other devices, as this functionality is only used here. It is generally recommended that all users update to 4.0.1, but especially all users who operate PLC Designer V4 in combination with the controllers mentioned.

Mitigatiesamenvatting

This vulnerability has been fixed in the new version. All users are strongly recommended to use the new version 4.0.1.

Risk evaluation

The Lenze VPN client is vulnerable to a Local Privilege Escalation to root/SYSTEM by executing a configuration file which can be controlled by a non-privileged user. This occurs through a race condition exploit, where an attacker can overwrite the temporary OpenVPN configuration file located in a world-writable directory. By injecting malicious commands into the configuration file prior to its execution by the VPN client, an attacker can trigger arbitrary code execution with root/system privileges when a VPN connection is initiated. The vulnerability has been remediated in the version 1.4.4 of the Lenze VPN client. Due to some further developments and completion of the functional scope, it is recommended to update the firmware of the x500 IoT Gateway devices immediately, regardless of the current security vulnerability in the VPN client.

Mitigatiesamenvatting

Obtain the updated VPN software (version >= 1.4.4) from https://cloud.lenze.digital/fleet-manager/tools and run the installer on a windows and macOS system or run the following commands in an linux system: tar -xzf vpn_client_x64.tar.gz cd vpn_client_x64 sudo ./install

Risk evaluation

The following tools: * VisiWinNET Smart * VisiWinNET Professional * EASY UI Designer create a directory with insufficient permissions, allowing a low-level user the ability to add and modify certain files that hold SYSTEM privileges, which could lead to privilege escalation.

Mitigatiesamenvatting

Only use this tool in a protected and controlled environment to minimize network impact and to ensure that the tool is inaccessable from outside. In addition, the use of firewalls is recommended to reduce the attack surface, specially to the internet and the internal business network.

Risk evaluation

The machine controller of the cabinet series include an OPC-UA server which uses an user management to authenticate clients via anonymous or user/password authentication. If the user/password authentication is selected, password verification is skipped upon second login. As a result, cases occur in which users can establish communication without correct authentication. This vulnerability is not located in the OPC-UA protocol or server, but in the interface to the products firmware. This Security Advisory is only relevant for the following use cases: • the user management has been activated on the machine controller (is deactivated by default) • the OPC-UA Server is used • Data are transferred via a symbol configuration (is not available by default)

Mitigatiesamenvatting

As part of a security strategy, Lenze SE recommends the following general defense measures to reduce the risk of exploits: • Only use the products in a protected and controlled environment to minimize network impact and to ensure that they are inaccessible from outside. • Use external firewalls to protect the automation system network and to separate it from other networks. Remark: One Measure should be to block port 4840 via the external firewall and open this port for authenticated access only. • Use Virtual Private Networks (VPN) tunnels when remote access is required. • Use IDS (Intrusion Detection Systems) where possible to detect anomalies in the network. • Activate and use user administration and password functions. • Use encrypted communication links. • Restrict access to both the development tools and their projects and the products of the automation system by physical means, operating system functions, etc. • Protect the development tool by using the latest virus detection solutions. • Use of certificate-based communication via the message security modes Sign or Sign&Encrypt and trust of the corresponding client certificates on the machine controller by the OPC-UA server. This can reduce the risk of exploiting this vulnerability.

Risk evaluation

The affected products contain a CODESYS Control runtime system in version V2. They are therefore affected by the vulnerability described in CODESYS Advisory 2021-06. It provides a communication server for the communication with clients like the CODESYS Development System. The 9400 servo inverters is only affected if the communication Path via the inserted EtherNet Module E94AYCEN on slot MXI1 or MXI2 is used. If the Module E94AYCEN is used, the following Versions are affected. Product Identification: E94xSHxxx (Single Drive, High Line) Product Identification: E94xMHxxx (Multi Drive, High Line) Remark: If the product identification of your 9400 product does not fit to the above mentioned identification, please contact Lenze at Security.de@Lenze.com. The Versions P (power supply module) and R (regenerative power supply module) are not affected. Furthermore, the Variant P (PLC) and the Variant S (StateLine) are not affected. The communication paths via the diagnostic interface X6, the system bus (CAN) X1 or the field buses (other than the named Ethernet module) that can be plugged into the module slots MXI1 or MXI2 are not affected. The focus is therefore on 9400 servo inverters with the product-identification E94x{S/M}{H}... with a plugged in Ethernet module E94AYCEN... in module slot MXI1 or MXI2 and communication with the Engineer-Tools via exactly this channel. In addition to the standard tool Engineer, there is also a special Version of the PLC Designer (Version 0.x). The communication path to the PLC Designer is not considered with the planned update and the vulnerabilities here remain even after the update. Here, the customer must provide a secure Environment, see Mitigation.

Mitigatiesamenvatting

As part of a security strategy, Lenze SE recommends the following general defense measures to reduce the risk of exploits: - Only use the products in a protected and controlled environment to minimize network impact and to ensure that they are inaccessible from outside. - Use firewalls to protect the automation system network and to separate it from other networks. Remark: One Measure should be to Block port 1200 via the firewall and open this port for authenticated access only. - Use Virtual Private Networks (VPN) tunnels when remote access is required. - Use IDS (Intrusion Detection Systems) where possible to detect anomalies in the network. - Activate and use user administration and password functions. - Use encrypted communication links. Restrict access to both the development tools and their projects and the products of the automation system by physical means, operating system functions, etc. - Protect the development tool by using the latest virus detection solutions.