Flaws with Ovarro’s TBox Remote Terminal Units Opens Industrial Systems For Remote Attacks

Recently, on March 23, the United States Computer Emergency Readiness Team (US-CERT) has proclaimed that in “Ovarro TBox” several vulnerabilities have been detected.

According to cybersecurity analysts, the exploitation of these vulnerabilities could generally enable threat actors to remotely execute code or execute a distributed denial-of-service (DDoS).

Flaws Detected

• CVE-2021-22646 – Improper control of generation of code (‘CODE INJECTION’) (CWE-94).
• CVE-2021-22648 – Incorrect permission assignment for the critical resource (CWE-732).
• CVE-2021-22642 – Uncontrolled resource consumption (CWE-400).
• CVE-2021-22640 – Insufficiently protected credentials (CWE-522).
• CVE-2021-22644 – Use of hard-coded cryptographic key (CWE-321).

Risk Assessment

All the risk that is linked with these vulnerabilities is not only the integrity of automation processes but also, in some cases public safety. 

However, utilizing all the security shortcomings will surely help to find some web-based interfaces, just like HMIs. It generally monitors process levels and other industrial activity. 

The experts asserted that they have noticed in the past what could go incorrect when such an interface is disclosed to the internet outwardly any security.

Here, the fact of such interfaces are exposed online and excludes many such obstacles to entry for opponents of all types of vulnerabilities.

But, the successful exploitation of these vulnerabilities could result in remote code execution, which may create a denial-of-service situation.

Products That are Affected

The affected products that are targeted by the attackers in this attack are mentioned below:-

• TBoxLT2 (All models)
• TBox TG2 (All models)
• TBox MS-CPU32
• TBox MS-CPU32-S2
• TBox RM2 (All models)
• All the versions prior to TWinSoft 12.4 and Firmware 1.46

Mitigation

This vulnerability has been listed as one of the most important vulnerabilities, along with a CVSS v3 score of 8.8. The security researchers have requested to note that these vulnerabilities have a low skill level that needs to exploit them, and can be exploited remotely. 

In case the users are using the applicable product, in that situation, it is quite beneficial to investigate the influence and orderly update to the version in which the issue is fixed.

Apart from this, CISA has recommended users to follow some basic precautions from their side, as this will surely help them to minimize the risk of exploitation of these vulnerabilities.

Reduce the network exposure for all control system devices, and also make sure that they are not available from the internet. Even users must locate the control system networks and remote devices behind firewalls and separate them from the business network.

In case of remote access is needed, then one should always use secure methods, like Virtual Private Networks (VPNs). However, acknowledging VPNs may have vulnerabilities and should be updated to the most popular version that is available. 

Not only this, but CISA has also provided a full section that only suggests the control systems security, which are recommended workouts on the ICS webpage on us-cert.cisa.gov.

Moreover, there are several suggested methods that are generally available for examination and download, which also include Improving Industrial Control Systems Cybersecurity with Defense-in-Depth techniques.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity, and hacking news updates.