Researchers Warn of Flaws in Widely Used Industrial Gas Analysis Equipment

A number of security flaws have been disclosed in Emerson Rosemount fuel chromatographs that could be exploited by destructive actors to attain sensitive information, induce a denial-of-services (DoS) situation, and even execute arbitrary commands.

The flaws impact GC370XA, GC700XA, and GC1500XA and reside in versions 4.1.5 and prior.

In accordance to operational technology (OT) security company Claroty, the vulnerabilities involve two command injection flaws and two separate authentication and authorization vulnerabilities that could be weaponized by unauthenticated attackers to conduct a large variety of malicious actions ranging from authentication bypass to command injection.

“Thriving exploitation of these vulnerabilities could permit an unauthenticated attacker with network access to run arbitrary commands, accessibility delicate details, result in a denial-of-company issue, and bypass authentication to acquire admin abilities,” the U.S. Cybersecurity and Infrastructure Security Company (CISA) stated in an advisory launched in January.

The chromatograph, which is applied for carrying out critical fuel measurements, can be configured and managed by implies of a software package identified as MON. The software package can also be applied to shop critical information and make reports this sort of as chromatograms, alarm record, party logs, and maintenance logs.

Claroty’s analysis of the firmware and the proprietary protocol used for communications in between the system and the Windows customer named MON2020 has revealed the pursuing shortcomings –

• CVE-2023-46687 (CVSS rating: 9.8) – An unauthenticated consumer with network entry could execute arbitrary instructions in root context from a remote laptop or computer

• CVE-2023-49716 (CVSS rating: 6.9) – An authenticated person with network obtain could operate arbitrary instructions from a remote laptop or computer

• CVE-2023-51761 (CVSS rating: 8.3) – An unauthenticated person with network access could bypass authentication and purchase admin capabilities by resetting the associated password

• CVE-2023-43609 (CVSS rating: 6.9) – An unauthenticated consumer with network accessibility could acquire accessibility to delicate info or lead to a denial-of-services ailment

Pursuing dependable disclosure, Emerson has introduced [PDF] an updated model of the firmware that addresses the vulnerabilities. The enterprise is also recommending conclude users to observe cybersecurity greatest procedures and ensure that the afflicted goods are not directly exposed to the internet.

The disclosure comes as Nozomi Networks detailed a number of flaws in AiLux RTU62351B that could be abused to access sensitive assets on the gadget, change its configuration, and even realize execution of arbitrary commands as root. The vulnerabilities have been collectively dubbed I11USION.

Flaws have also been determined in Proges As well as temperature checking products and their connected application, particularly Sensor Net Link and Thermoscan IP, that could allow admin privileges more than critical medical devices, thereby generating it possible for a destructive actor to manipulate method configurations, install malware, and exfiltrate knowledge.

These vulnerabilities, which continue being unpatched, could also end result in a DoS ailment of healthcare monitoring infrastructure, top to spoilage of temperature-delicate medicines and vaccines.

Located this posting appealing? Abide by us on Twitter  and LinkedIn to browse extra distinctive written content we put up.

Some components of this report are sourced from:
thehackernews.com