<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<font color="#3333ff">IPC=Industrial PC. More automation companies
are using IPCs running a PLC software development and PLC
emulation programs like CoDeSys with Linux as the host OS.<br>
<br>
Wago manufacturers I&C connectivity solutions like terminal
blocks, DIN rail mounted I&C infrastructure and, more
recently, compact industrial automation and network
infrastructure (think Phoenix blocks). Knowing Wago, the product
mentioned is likely a re-brand of a generic PLC.<br>
This begs the question - what other re-branded PLCs have the same
issue?<br>
Not sure if there are any at JLab.<br>
<br>
Many PLCs, HMIs, and programming software more than a year old are
showing up with hard-coded user credentials. </font><br>
<br>
<font color="#3333ff">In addition to Wago, CoDeSys is used to
program products from Beck, Sontheim, Brunner, Kuhnke, SETEX,
Volkel, Eaton Automation, Lenze, Messing, Owen, Hilsher, Biviator,
cpa Computer Process Automation, E. Dodd, and TRsystems.</font><br>
<br>
<br>
<font color="#3333ff">KM</font><br>
<br>
<pre>ICS-CERT has released the Alert titled "ICS-ALERT-12-097-01 &ndash; WAGO IPC Multiple Vulnerabilities" that can be accessed at <a class="moz-txt-link-abbreviated" href="http://www.ics-cert.org">www.ics-cert.org</a> or directly through the following link:
<a class="moz-txt-link-freetext" href="http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-12-097-01.pdf">http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-12-097-01.pdf</a>.
ICS-CERT has released the Alert titled "ICS-ALERT-12-097-02 &ndash; 3S-Software CoDeSys Improper Access Control" that can be accessed at <a class="moz-txt-link-abbreviated" href="http://www.ics-cert.org">www.ics-cert.org</a> or directly through the following link:
<a class="moz-txt-link-freetext" href="http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-12-097-02.pdf">http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-12-097-02.pdf</a>.
ICS-ALERT-12-097-01 &ndash; WAGO IPC Multiple Vulnerabilities
Summary
ICS-CERT is aware of a public report of multiple vulnerabilities affecting the WAGO IPC 758-870, which is an embedded Linux programmable logic controller (PLC). According to this report, an attacker could exploit these vulnerabilities to gain unauthorized access or to make unauthenticated configuration changes, which may include arbitrary code. The &ldquo;Improper Access Control&rdquo; vulnerability is the same vulnerability identified in ICS-ALERT-12-097-02&mdash;3S Software CoDeSys Improper Access Control. This report was released by Reid Wightman, Digital Bond, without coordination with either the vendor or ICS-CERT.
ICS-CERT has notified the affected vendor of the report and has asked the vendor to confirm the vulnerability and identify mitigations. ICS-CERT is issuing this alert to provide early notice of the report and identify baseline mitigations for reducing risks to these and other cybersecurity attacks.
The report included vulnerability details for the following vulnerabilities:
Hard-coded Password
Exploitability: Remote
Impact: Loss of integrity
Improper Access Control
Exploitability: Remote
Impact: Loss of integrity, possible arbitrary code execution
===============================================
ICS-ALERT-12-097-02 &ndash; 3S-Software CoDeSys Improper Access Control
Summary
ICS-CERT is aware of a public report of improper access control vulnerability affecting 3S-Software CoDeSys. CoDeSys is a third party product used on programmable logic controllers and engineering workstations. According to this report, an attacker can upload unauthenticated configuration changes to the PLC which may include arbitrary code. This report was released by Reid Wightman, Digital Bond, without coordination with either the vendor or ICS-CERT.
ICS-CERT has notified the affected vendor of the report and has asked the vendor to confirm the vulnerability and identify mitigations. ICS-CERT is issuing this alert to provide early notice of the report and identify baseline mitigations for reducing risks to these and other cybersecurity attacks.
The report included vulnerability details for the following vulnerability:
Improper Access Control
Exploitability: Remote
Impact: Loss of integrity
================================================
Please report any issues affecting control systems in critical infrastructure environments to ICS-CERT.
Mitigation
ICS-CERT is currently coordinating with the vendor and security researcher to identify mitigations.
ICS-CERT Operations Center
1-877-776-7585
<a class="moz-txt-link-abbreviated" href="mailto:ics-cert@dhs.gov">ics-cert@dhs.gov</a>
<a class="moz-txt-link-abbreviated" href="http://www.ics-cert.org">www.ics-cert.org</a>
</pre>
</body>
</html>