CISA Warns of Flaws in Siemens, GE Digital, and Contec Industrial Control Systems

Jan 18, 2023Ravie LakshmananICS/SCADA Security

The U.S. Cybersecurity and Infrastructure Security Agency (CISA)
has published^[1]
four Industrial Control Systems (ICS) advisories, calling out
several security flaws affecting products from Siemens, GE Digital,
and Contec.

The most critical of the issues have been identified in Siemens
SINEC INS that could lead to remote code execution via a path
traversal flaw (CVE-2022-45092^[2], CVSS score: 9.9) and
command injection (CVE-2022-2068^[3], CVSS score: 9.8).

Also patched by Siemens is an authentication bypass
vulnerability in llhttp parser (CVE-2022-35256^[4], CVSS score: 9.8) as
well as an out-of-bounds write bug in the OpenSSL library (CVE-2022-2274^[5], CVSS score: 9.8) that
could be exploited to trigger remote code execution.

The German automation company, in December 2022, released^[6]
Service Pack 2 Update 1 software to mitigate the flaws.

Separately, a critical flaw has also been revealed in GE
Digital’s Proficy Historian solution that could result in code
execution regardless of authentication status. The issue, tracked
as CVE-2022-46732 (CVSS score: 9.8), impacts Proficy Historian
versions 7.0 and higher, and has been remediated in Proficy Historian 2023^[7].

“An attacker can take advantage of this fact and bypass the
historian authentication by impersonating a local service,” Uri
Katz, security researcher at industrial security firm Claroty,
said^[8]. “This allows remote
attackers the ability to log in to any GE Proficy Historian server
and force it to perform unauthorized actions.”

CISA also updated an ICS advisory that was published last month,
detailing a critical command injection vulnerability in Contec
CONPROSYS HMI System (CVE-2022-44456, CVSS score: 10.0) that could
permit a remote attacker to send specially crafted requests to
execute arbitrary commands.

While this shortcoming was patched by Contec in version 3.4.5,
the software has since been found to be vulnerable to four
additional defects that could lead to information disclosure and
unauthorized access.

Users of CONPROSYS HMI System are recommended to update to
version 3.5.0 or later, in addition to taking steps to minimize
network exposure and isolate such devices from business
networks.

The advisories come less than a week after CISA released
12 such alerts^[9]
warning of critical flaws impacting software from Sewio, InHand
Networks, Sauter Controls, and Siemens.