- Connected Car: Start Thinking Security
- Rockwell Fixes Parser Buffer Overflow
- Oil and Gas Security ‘Not Keeping Pace’
- Ground Control Maker Stays SHARP
- Parsons Reapproved for OSHA Safety Program
- Worker Dies in Manufacturing Incident
- ARC: Open, Secure Systems Moving Forward
- ARC: Take ‘Crown Jewels’ Offline
Chemical Safety Incidents
Moxa Fixes Switch Vulnerability
Thursday, June 16, 2016 @ 03:06 PM gHale
Moxa updated its Industrial Ethernet Switch PT-7728 series to mitigate an improper authorization vulnerability, according to a report on ICS-CERT.
Independent researcher Can Demirel, who discovered the flaw, tested the update to validate that it resolves the remotely exploitable vulnerability.
PT-7728 Series Version 3.4 build 15081113 suffers from the issue.
Successful exploitation of this vulnerability may allow an attacker to access management functions. Attackers can update switch configuration.
Moxa is a Taiwan-based company that maintains offices in several countries around the world, including the U.S., UK, India, Germany, France, China, Russia, and Brazil.
The affected products, PT-7728 series, are managed Ethernet switches designed especially for industrial applications.
Moxa said the PT-7728 series switches see action across several sectors, including chemical, commercial facilities, critical manufacturing, emergency services, energy, food and agriculture, government facilities, and water and wastewater systems.
Moxa said these products see use on a global basis, but mainly in the U.S., Europe, Chile, Argentina, Peru, Columbia, and Taiwan, with 50 to 60 percent of all sales in the U.S.
The switch series support least privilege account with given credentials. The default user account has limited access to switch functions. Using local proxy to interrupt traffic, the switch configuration can end up updated. It means least privilege account can access and modify critical switch configuration.
CVE-2016-4514 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 7.7.
No known public exploits specifically target this vulnerability. Crafting a working exploit for this vulnerability would be difficult. Local proxy must end up used to interrupt traffic and update switch configuration.
Moxa has produced an update to mitigate this vulnerability. The update is available upon request.