Friday, March 29, 2024

Flaws with Ovarro’s TBox Remote Terminal Units Opens Industrial Systems For Remote Attacks

Recently, on March 23, the United States Computer Emergency Readiness Team (US-CERT) has proclaimed that in “Ovarro TBox” several vulnerabilities have been detected.

According to cybersecurity analysts, the exploitation of these vulnerabilities could generally enable threat actors to remotely execute code or execute a distributed denial-of-service (DDoS).

Flaws Detected

  • CVE-2021-22646 – Improper control of generation of code (‘CODE INJECTION’) (CWE-94).
  • CVE-2021-22648 – Incorrect permission assignment for the critical resource (CWE-732).
  • CVE-2021-22642 – Uncontrolled resource consumption (CWE-400).
  • CVE-2021-22640 – Insufficiently protected credentials (CWE-522).
  • CVE-2021-22644 – Use of hard-coded cryptographic key (CWE-321). 

Risk Assessment

All the risk that is linked with these vulnerabilities is not only the integrity of automation processes but also, in some cases public safety. 

However, utilizing all the security shortcomings will surely help to find some web-based interfaces, just like HMIs. It generally monitors process levels and other industrial activity. 

The experts asserted that they have noticed in the past what could go incorrect when such an interface is disclosed to the internet outwardly any security.

Here, the fact of such interfaces are exposed online and excludes many such obstacles to entry for opponents of all types of vulnerabilities.

But, the successful exploitation of these vulnerabilities could result in remote code execution, which may create a denial-of-service situation.

Products That are Affected

The affected products that are targeted by the attackers in this attack are mentioned below:-

  • TBoxLT2 (All models)
  • TBox TG2 (All models)
  • TBox MS-CPU32
  • TBox MS-CPU32-S2
  • TBox RM2 (All models)
  • All the versions prior to TWinSoft 12.4 and Firmware 1.46

Mitigation

This vulnerability has been listed as one of the most important vulnerabilities, along with a CVSS v3 score of 8.8. The security researchers have requested to note that these vulnerabilities have a low skill level that needs to exploit them, and can be exploited remotely. 

In case the users are using the applicable product, in that situation, it is quite beneficial to investigate the influence and orderly update to the version in which the issue is fixed.

Apart from this, CISA has recommended users to follow some basic precautions from their side, as this will surely help them to minimize the risk of exploitation of these vulnerabilities.

Reduce the network exposure for all control system devices, and also make sure that they are not available from the internet. Even users must locate the control system networks and remote devices behind firewalls and separate them from the business network.

In case of remote access is needed, then one should always use secure methods, like Virtual Private Networks (VPNs). However, acknowledging VPNs may have vulnerabilities and should be updated to the most popular version that is available. 

Not only this, but CISA has also provided a full section that only suggests the control systems security, which are recommended workouts on the ICS webpage on us-cert.cisa.gov.

Moreover, there are several suggested methods that are generally available for examination and download, which also include Improving Industrial Control Systems Cybersecurity with Defense-in-Depth techniques.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity, and hacking news updates.

Website

Latest articles

IT and security Leaders Feel Ill-Equipped to Handle Emerging Threats: New Survey

A comprehensive survey conducted by Keeper Security, in partnership with TrendCandy Research, has shed...

How to Analyse .NET Malware? – Reverse Engineering Snake Keylogger

Utilizing sandbox analysis for behavioral, network, and process examination provides a foundation for reverse...

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles