Team82 recently discovered three new Windows-based vulnerabilities in B&R Automation Studio, an integrated industrial automation software environment that supports a wide range of operational technology (OT) functions, including controls, human machine interfaces (HMIs), and safety. B&R Automation Studio is used globally, particularly among chemical, energy, and critical manufacturing companies.
The discovered vulnerabilities relate specifically to the product's update service, require a low level of skill to exploit, and can be leveraged through remote code execution. After being notified by Claroty, B&R Automation issued patches for these vulnerabilities, as well as a US-CERT advisory.
B&R Automation says it has not found evidence indicating any of the vulnerabilities discovered by Claroty have been used maliciously. That being said, Preminger and Anikster's findings provide an illustrative example of how an attacker can leverage software vulnerabilities to exploit computers used for engineering work within an OT environment.
The specific nature of the vulnerabilities uncovered by Claroty are as follows:
Improper privilege management (CVE-2019-19100): This privilege escalation vulnerability could allow authenticated users to delete arbitrary files via an exposed interface.
Missing required cryptographic step (CVE-2019-19101): This missing security communication definition, which leads to incomplete TLS encryption and validation, can enable unauthenticated users to perform man-in-the middle (MITM) attacks via the B&R upgrade server.
Path traversal (CVE-2019-19102): This directory traversal vulnerability in SharpZipLib, also known as a "zip slip," allows unauthenticated users to write to certain local directories.
According to Preminger, an attacker could combine the missing required cryptographic step with the path traversal vulnerability to intervene during a software update, conduct a MITM attack, and install their own malicious code within a victim's network. Leveraging these vulnerabilities, a threat actor could conduct a DNS cache poisoning attack against computers within an OT network while posing as the B&R update server to avoid detection.
In a DNS cache poisoning attack, also known as DNS spoofing, an adversary diverts traffic to a malicious destination while altering DNS records to create the impression of normal, legitimate activity. "This attack is based on hijacking a domain, which becomes much easier if the attacker has gained access to a closed ICS network," Preminger explained in a recent interview with SecurityWeek. "Often, there are no DNS servers to respond to the client. Windows will fallback to local discovery protocols, which are easier to deceive."
B&R Automation recommends applying product updates at the earliest convenience and has provided several workaround mitigations for users unable to upgrade immediately.
To learn more about how Claroty can help your team discover and mitigate vulnerabilities within your OT environment, request a demo.
CWE-547 USE OF HARD-CODED, SECURITY-RELEVANT CONSTANTS:
Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 are vulnerable to an attacker impersonating the web application service and mislead victim clients.
Optigo Networks recommends users to upgrade to the following:
CVSS v3: 7.5
CWE-288 AUTHENTICATION BYPASS USING AN ALTERNATE PATH OR CHANNEL:
Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 contain an exposed web management service that could allow an attacker to bypass authentication measures and gain controls over utilities within the products.
Optigo Networks recommends users to upgrade to the following:
CVSS v3: 9.8
CWE-547 USE OF HARD-CODED, SECURITY-RELEVANT CONSTANTS:
Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 contain a hard coded secret key. This could allow an attacker to generate valid JWT (JSON Web Token) sessions.
Optigo Networks recommends users to upgrade to the following:
CVSS v3: 7.5
CWE-912 HIDDEN FUNCTIONALITY:
The "update" binary in the firmware of the affected product sends attempts to mount to a hard-coded, routable IP address, bypassing existing device network settings to do so. The function triggers if the 'C' button is pressed at a specific time during the boot process. If an attacker is able to control or impersonate this IP address, they could upload and overwrite files on the device.
Per FDA recommendation, CISA recommends users remove any Contec CMS8000 devices from their networks.
If asset owners cannot remove the devices from their networks, users should block 202.114.4.0/24 from their networks, or block 202.114.4.119 and 202.114.4.120.
Please note that this device may be re-labeled and sold by resellers.
Read more here: Do the CONTEC CMS8000 Patient Monitors Contain a Chinese Backdoor? The Reality is More Complicated….
CVSS v3: 7.5
CWE-295 IMPROPER CERTIFICATE VALIDATION:
The affected product is vulnerable due to failure of the update mechanism to verify the update server's certificate which could allow an attacker to alter network traffic and carry out a machine-in-the-middle attack (MITM). An attacker could modify the server's response and deliver a malicious update to the user.
Medixant recommends users download the v2025.1 or later version of their software.
CVSS v3: 5.7
