A number of security flaws have been disclosed in Emerson Rosemount fuel chromatographs that might be exploited by malicious actors to acquire delicate info, induce a denial-of-service (DoS) situation, and even execute arbitrary instructions.
The failings impression GC370XA, GC700XA, and GC1500XA and reside in variations 4.1.5 and prior.
In accordance with operational expertise (OT) security agency Claroty, the vulnerabilities embody two command injection flaws and two separate authentication and authorization vulnerabilities that might be weaponized by unauthenticated attackers to carry out a variety of malicious actions starting from authentication bypass to command injection.
“Profitable exploitation of those vulnerabilities may enable an unauthenticated attacker with community entry to run arbitrary instructions, entry delicate info, trigger a denial-of-service situation, and bypass authentication to amass admin capabilities,” the U.S. Cybersecurity and Infrastructure Safety Company (CISA) stated in an advisory launched in January.
The chromatograph, which is used for finishing up important fuel measurements, could be configured and managed by the use of a software program referred to as MON. The software program can be used to retailer important information and generate reviews similar to chromatograms, alarm historical past, occasion logs, and upkeep logs.
Claroty’s evaluation of the firmware and the proprietary protocol used for communications between the gadget and the Home windows shopper named MON2020 has revealed the next shortcomings –
- CVE-2023-46687 (CVSS rating: 9.8) – An unauthenticated person with community entry may execute arbitrary instructions in root context from a distant laptop
- CVE-2023-49716 (CVSS rating: 6.9) – An authenticated person with community entry may run arbitrary instructions from a distant laptop
- CVE-2023-51761 (CVSS rating: 8.3) – An unauthenticated person with community entry may bypass authentication and purchase admin capabilities by resetting the related password
- CVE-2023-43609 (CVSS rating: 6.9) – An unauthenticated person with community entry may acquire entry to delicate info or trigger a denial-of-service situation
Following accountable disclosure, Emerson has launched [PDF] an up to date model of the firmware that addresses the vulnerabilities. The corporate can also be recommending finish customers to comply with cybersecurity greatest practices and be certain that the affected merchandise are usually not straight uncovered to the web.
The disclosure comes as Nozomi Networks detailed a number of flaws in AiLux RTU62351B that might be abused to entry delicate assets on the gadget, alter its configuration, and even obtain execution of arbitrary instructions as root. The vulnerabilities have been collectively dubbed I11USION.
Flaws have additionally been recognized in Proges Plus temperature monitoring gadgets and their related software program, specifically Sensor Internet Join and Thermoscan IP, that would allow admin privileges over important medical methods, thereby making it potential for a malicious actor to control system settings, set up malware, and exfiltrate information.
These vulnerabilities, which stay unpatched, may additionally lead to a DoS situation of medical monitoring infrastructure, resulting in spoilage of temperature-sensitive medicines and vaccines.
