ABB Clears WiFi Logger Card Hole

Tuesday, July 11, 2017 @ 04:07 PM gHale


ABB has new firmware that mitigates multiple vulnerabilities in its VSN300 WiFi Logger Card, according to a report with ICS-CERT.

The vulnerabilities, discovered by Maxim Rupp, include an improper authentication and permissions, privileges, and access controls issues.

RELATED STORIES
Fix is in for PI Coresight
OSIsoft Fixes PI ProcessBook, PI ActiveView
Schweitzer Clears Hole in Gateways
Schneider Patches Ampla MES Holes

The following versions of VSN300 WiFi Logger Card, a device for solar system monitoring, suffer from the remotely exploitable vulnerabilities:
• VSN300 WiFi Logger Card versions 1.8.15 and prior
• VSN300 WiFi Logger Card for React versions 2.1.3 and prior

Successful exploitation of these vulnerabilities could allow attackers to gain unauthorized access to privileged information

No known public exploits specifically target these vulnerabilities. However, an attacker with low skill level could leverage the vulnerabilities.

In one vulnerability, by accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to access internal information about status and connected devices without authenticating.

CVE-2017-7920 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 7.5.

In the permissions, privileges and access controls vulnerability, the web application does not properly restrict privileges of the “Guest” account. A malicious user may be able to gain access to configuration information that should be restricted.

CVE-2017-7916 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 6.5.

The product mainly covers the energy sector and it sees action on a global basis.

Zurich, Switzerland-based ABB recommends users update firmware to version 1.9.0 or newer for WiFi Logger Card, and version 2.2.5 or newer for WiFi Logger Card for React. This can be done via remote firmware updating with Aurora Vision or via integrated web user interface by downloading the firmware from the ABB server.

Users can click here for more information from ABB’s security advisory.



Leave a Reply

You must be logged in to post a comment.