Energy Meter Vulnerabilities

Wednesday, September 14, 2016 @ 08:09 AM gHale


There is a public report of authentication vulnerabilities with proof-of-concept (PoC) exploit code affecting FENIKS PRO Elnet LT Energy & Power analyzer, according to a report with ICS-CERT.

Attackers can manage the device remotely without authentication, according to the report.

RELATED STORIES
Siemens Updates SIPROTEC 4, SIPROTEC
Westermo Switch Issue Updated
Moxa Fixes OnCell Vulnerabilities
Navis Mitigates SQL Vulnerability

This report released after ICS-CERT failed to coordinate the vulnerabilities with FENIKS PRO.

ICS-CERT notified the vendor of the report and asked the vendor to confirm the vulnerabilities and identify mitigations. ICS-CERT issuing an alert to provide early notice of the report and identify baseline mitigations for reducing risks to these and other cybersecurity attacks.

The report included vulnerability details and PoC exploit code for the following vulnerability: An unauthenticated web management access that is remotely exploitable and could lead to possible remote code execution.

ICS-CERT recommends that users of these devices (or any other control system device) change passwords from the default settings upon installation of the product.

Elnet LT is a power meter for electrical measurements and harmonics with RS485 communication.