The U.S. Cybersecurity and Infrastructure Security Agency (CISA)
on Tuesday released[1]
an advisory regarding multiple security vulnerabilities affecting
all versions of Honeywell Experion Process Knowledge System C200,
C200E, C300, and ACE controllers that could be exploited to achieve
remote code execution and denial-of-service (DoS) conditions.
“A Control Component Library (CCL) may be modified by a bad
actor and loaded to a controller such that malicious code is
executed by the controller,” Honeywell noted[2]
in an independent security notification published earlier this
February. Credited with discovering and reporting the flaws are Rei
Henigman and Nadav Erez of industrial cybersecurity firm
Claroty.
Experion Process Knowledge System (PKS) is a distributed control
system (DCS[3]) that’s designed to
control large industrial processes spanning a variety of sectors
ranging from petrochemical refineries to nuclear power plants where
high reliability and security is important.
The list of three flaws is as follows –
- CVE-2021-38397 (CVSS score: 10.0) –
Unrestricted Upload of File with Dangerous Type - CVE-2021-38395 (CVSS score: 9.1) – Improper
Neutralization of Special Elements in Output Used by a Downstream
Component - CVE-2021-38399 (CVSS score: 7.5) – Relative
Path Traversal
According to Claroty, the issues hinge on the download code
procedure that’s essential to program the logic running in the
controller, thus enabling an attacker to mimic the process and
upload arbitrary CLL binary files. “The device then loads the
executables without performing checks or sanitization, giving an
attacker the ability to upload executables and run unauthorized
native code remotely without authentication,” researchers Henigman
and Erez said[4].
In a nutshell, successful exploitation of the shortcomings could
permit a malicious party to access unauthorized files and
directories, and worse, remotely execute arbitrary code and cause a
denial-of-service condition. To prevent loading a modified CCL with
malicious code to a controller, Honeywell has incorporated
additional security enhancements by cryptographically signing each
CCL binary that’s validated prior to its use.
Users are urged to update or patch as soon as possible in order
to mitigate these vulnerabilities fully.