A number of safety flaws have been disclosed in Emerson Rosemount gasoline chromatographs that could possibly be exploited by malicious actors to acquire delicate info, induce a denial-of-service (DoS) situation, and even execute arbitrary instructions.
The issues affect GC370XA, GC700XA, and GC1500XA and reside in variations 4.1.5 and prior.
In keeping with operational know-how (OT) safety agency Claroty, the vulnerabilities embody two command injection flaws and two separate authentication and authorization vulnerabilities that could possibly be weaponized by unauthenticated attackers to carry out a variety of malicious actions starting from authentication bypass to command injection.
“Profitable exploitation of those vulnerabilities may permit an unauthenticated attacker with community entry to run arbitrary instructions, entry delicate info, trigger a denial-of-service situation, and bypass authentication to amass admin capabilities,” the U.S. Cybersecurity and Infrastructure Safety Company (CISA) mentioned in an advisory launched in January.
The chromatograph, which is used for finishing up vital gasoline measurements, might be configured and managed by the use of a software program known as MON. The software program may also be used to retailer vital information and generate studies resembling chromatograms, alarm historical past, occasion logs, and upkeep logs.
Claroty’s evaluation of the firmware and the proprietary protocol used for communications between the machine and the Home windows consumer named MON2020 has revealed the next shortcomings –
- CVE-2023-46687 (CVSS rating: 9.8) – An unauthenticated person with community entry may execute arbitrary instructions in root context from a distant laptop
- CVE-2023-49716 (CVSS rating: 6.9) – An authenticated person with community entry may run arbitrary instructions from a distant laptop
- CVE-2023-51761 (CVSS rating: 8.3) – An unauthenticated person with community entry may bypass authentication and purchase admin capabilities by resetting the related password
- CVE-2023-43609 (CVSS rating: 6.9) – An unauthenticated person with community entry may get hold of entry to delicate info or trigger a denial-of-service situation
Following accountable disclosure, Emerson has launched [PDF] an up to date model of the firmware that addresses the vulnerabilities. The corporate can also be recommending finish customers to comply with cybersecurity finest practices and be sure that the affected merchandise aren’t immediately uncovered to the web.
The disclosure comes as Nozomi Networks detailed a number of flaws in AiLux RTU62351B that could possibly be abused to entry delicate assets on the machine, alter its configuration, and even obtain execution of arbitrary instructions as root. The vulnerabilities have been collectively dubbed I11USION.
Safety flaws have additionally been recognized in Proges Plus temperature monitoring units and their related software program, particularly Sensor Internet Join and Thermoscan IP, that would allow admin privileges over vital medical techniques, thereby making it attainable for a malicious actor to control system settings, set up malware, and exfiltrate information.
These vulnerabilities, which stay unpatched, may additionally lead to a DoS situation of medical monitoring infrastructure, resulting in spoilage of temperature-sensitive medicines and vaccines.
