There is a public report detailing multiple vulnerabilities with proof-of-concept (PoC) exploit code affecting xArrow, a supervisory control and data acquisition/human-machine interface (SCADA/HMI) product.
These vulnerabilities, released by independent security researcher Luigi Auriemma without coordination with either the vendor, ICS-CERT, or any other coordination entity, are remotely exploitable.
RELATED STORIES
ABB Patches Robot Software
Advantech’s New Version of WebAccess
DLL Hijacking Hole with 7T
Threat Alert Reaches New High
ICS-CERT is attempting to coordinate the report with the vendor in order to confirm the vulnerabilities and identify mitigations. ICS-CERT is issuing this alert to provide early notice of the report and identify baseline mitigations.
The report included vulnerability details and PoC exploit code for the following vulnerabilities:
The vulnerabilities include a decompression NULL pointer; heap corruption; invalid read access, and memory corruption. All vulnerabilities are remotely exploitable and can cause a denial of service (DoS) or in the case of the heap corruption, additionally, a possible arbitrary code execution.