CISA Warns of Critical ICS Flaws in Hitachi, mySCADA, ICL, and Nexx Products

Apr 07, 2023Ravie LakshmananIndustrial Control System

The U.S. Cybersecurity and Infrastructure Security Agency (CISA)
has published^[1]
eight^[2]
Industrial Control Systems (ICS) advisories warning of critical
flaws affecting products from Hitachi Energy, mySCADA Technologies,
Industrial Control Links, and Nexx.

Topping the list is CVE-2022-3682^[3]
(CVSS score: 9.9), impacting Hitachi Energy’s MicroSCADA System
Data Manager SDM600 that could allow an attacker to take remote
control of the product.

The flaw stems from an issue with file permission validation,
thereby permitting an adversary to upload a specially crafted
message to the system, leading to arbitrary code execution.

Hitachi Energy has released SDM600 1.3.0.1339 to mitigate^[4]
the issue for SDM600 versions prior to version 1.2 FP3 HF4 (Build
Nr. 1.2.23000.291).

Another set of five critical vulnerabilities – CVE-2023-28400^[5], CVE-2023-28716^[6], CVE-2023-28384^[7], CVE-2023-29169^[8], and CVE-2023-29150^[9]
(CVSS scores: 9.9) – relate to command injection bugs present in
mySCADA myPRO versions 8.26.0 and prior.

“Successful exploitation of these vulnerabilities could allow an
authenticated user to inject arbitrary operating system commands,”
CISA warned, urging users to update to version 8.29.0 or
higher.

A critical security bug has also been disclosed in Industrial
Control Links ScadaFlex II SCADA Controllers (CVE-2022-25359^[10], CVSS score: 9.1) that
could allow an authenticated attacker to overwrite, delete, or
create files.

“Industrial Control Links has relayed that they are closing
their business,” the agency said. “This product may be considered
end-of-life; continued support for this product may be
unavailable.”

Users are recommended to minimize network exposure, isolate
control system networks from business networks, and place them
behind firewalls to address potential risks.

Rounding off the list are five shortcomings, including one
critical bug (CVE-2023-1748^[11], CVSS score: 9.3),
impacting garage door controllers, smart plugs, and smart alarms
sold by Nexx.

The vulnerabilities that could enable threat actors to crack
open home garage doors, take over smart plugs, and gain remote
control of smart alarms, according to security researcher Sam Sabetan^[12], who discovered and
reported the issues.

The following versions of Nexx smart home devices are affected
–

• Nexx Garage Door Controller (NXG-100B, NXG-200) – Version
  nxg200v-p3-4-1 and prior
• Nexx Smart Plug (NXPG-100W) – Version nxpg100cv4-0-0 and
  prior
• Nexx Smart Alarm (NXAL-100) – Version nxal100v-p1-9-1and
  prior

“Successful exploitation of these vulnerabilities could allow an
attacker to receive sensitive information, execute application
programmable interface (API) requests, or hijack devices,” CISA
said.