Rockwell Automation industrial energy meter vulnerable to public exploits
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-19615 | Multiple XSS vulnerabilities exist in the Backup & Restore module \ v14.0.10.2 through v14.0.10.7 for FreePBX, as shown at /admin/config.php?display=backup on t Multiple XSS vulnerabilities exist in the Backup & Restore module \ v14.0.10.2 through v14.0.10.7 for FreePBX, as shown at /admin/config.php?display=backup on the FreePBX Administrator web site. An attacker can modify the id parameter of the backup configuration screen and embed malicious XSS code via a link. When another user (such as an admin) clicks the link, the XSS payload will render and execute in the context of the victim user's account. NVD description · AI analysis pending | 4.8 | <1% |
| — | ||
| CVE-2019-19616 | An Insecure Direct Object Reference (IDOR) vulnerability in the Xtivia Web Time and Expense (WebTE) interface used for Microsoft Dynamics NAV before 2017 allows An Insecure Direct Object Reference (IDOR) vulnerability in the Xtivia Web Time and Expense (WebTE) interface used for Microsoft Dynamics NAV before 2017 allows an attacker to download arbitrary files by specifying arbitrary values for the recId and filename parameters of the /Home/GetAttachment function. NVD description · AI analysis pending | 4.3 | <1% |
| — |
Full article302 words · extracted from helpnetsecurity.com · click to collapse
A low-skilled, remote attacker could use publicly available exploits to gain access to and mess with a power monitor by Rockwell Automation that is used by energy companies worldwide, ICS-CERT warns.
All versions of Rockwell Automation’s Allen-Bradley PowerMonitor 1000 are vulnerable and there is currently no available fix for the flaws.
About the vulnerabilities and available exploits
PowerMonitor 1000 is an energy metering device used in industrial control applications, such as destribution centers, industrial control panels, and motor control centers.
It measures voltage and current in an electrical circuit and communicates power and energy parameters to applications such as FactoryTalk EnergyMetrixTM, SCADA systems, and programmable controllers, over Ethernet or serial networks.
The discovered vulnerabilities are two:
- CVE-2019-19615, a cross-site scripting flaw that coula allow a remote attacker to inject arbitrary code into a targeted user’s web browser to gain access to the affected device
- CVE-2019-19616, an authentication bypass that could allow a remote attacker to use a proxy to enable functionality that is typically available to those with administrative rights for the web application. Once the authentication is bypassed, the attacker can change user settings and the device configuration.
Luca Chiou of ACSI, who has been credited with finding and reporting both flaws to the NCCIC (National Cybersecurity & Communications Integration Center), has also released PoC exploits for both of them (1, 2).
Of the two, the latter is currently more dangerous, as it appears that attackers might already be using it.
“Rockwell Automation is currently working on mitigations and reports that CheckPoint Software Technologies has released IPS rules to detect attempts to exploit CVE-2019-19615,” ICS-CERT explained.
Until fixes are provided, they advise administrators to ensure that the affected devices are not accessible from the Internet, are located behind firewall and isolated from the business network.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2019/02/20/rockwell-automation-industrial-energy-meter-vulnerable-to-public-exploits/