Fast Facts
- Two critical vulnerabilities (CVE-2023-40151 and CVE-2023-42770) affect Red Lion Sixnet RTUs, allowing unauthenticated remote code execution with root privileges.
- CVE-2023-42770 exploits an authentication bypass in UDP and TCP ports, while CVE-2023-40151 leverages Linux shell command support for remote code execution.
- These flaws may enable attackers to chain attacks, risking serious industrial control system disruptions; patches and enabling user authentication are highly recommended.
- Impacted products include various firmware versions across Red Lion’s Sixnet RTU series, with US CISA emphasizing the threat to critical infrastructure operations.
Problem Explained
Cybersecurity researchers recently uncovered two severe vulnerabilities (CVE-2023-40151 and CVE-2023-42770) in Red Lion’s Sixnet remote terminal units (RTUs), which are widely used in critical industries such as energy, water, and manufacturing for automation and control. These flaws allow an unauthenticated attacker to execute arbitrary commands with root privileges, effectively compromising the devices. The first flaw involves an authentication bypass due to a port listening issue, where TCP connections are accepted without proper authentication, while the second enables remote code execution by exploiting the RTU’s Linux shell command support. Together, these vulnerabilities can be exploited to take full control of affected devices, potentially leading to operational disruptions or damage in essential industrial processes. The report from Claroty, supported by an alert from the U.S. Cybersecurity and Infrastructure Security Agency (CISA), stresses the urgency for users to apply patches and tighten security measures, such as enabling user authentication and blocking access over TCP, to prevent malicious attacks on these critical systems.
Risk Summary
Cyber risks pose a profound threat to critical infrastructure, exemplified by recent vulnerabilities discovered in Red Lion Sixnet RTUs used in sectors like energy, water, and manufacturing. Two critical flaws, CVE-2023-40151 and CVE-2023-42770, enable unauthorized attackers to bypass authentication or execute code with root privileges remotely, potentially leading to catastrophic disruption, manipulation, or damage to industrial processes. These vulnerabilities exploit inherent weaknesses in the device’s communication protocols and software, allowing malicious actors to gain high-level control over essential control systems if unpatched or misconfigured, thus jeopardizing public safety, economic stability, and national security. The widespread deployment of affected RTUs underscores the urgency for immediate patching, enhanced authentication measures, and access restrictions, as exploitation could result in severe operational, environmental, and safety consequences.
Possible Remediation Steps
In the realm of industrial control systems, swift action is crucial when high-severity vulnerabilities are identified, such as the two CVSS 10.0 bugs found in Red Lion RTUs that could grant hackers full control. Delay in addressing these flaws can lead to catastrophic operational disruptions, safety hazards, and significant financial losses.
Mitigation Strategies
- Apply Patches: Implement applicable security updates released by Red Lion to fix the vulnerabilities immediately.
- Network Segmentation: Isolate RTUs from other network segments to prevent unauthorized access.
- Access Controls: Enforce strict user authentication and authorization protocols to limit device access.
- Firewall Rules: Configure firewalls to block malicious or non-essential traffic targeting the RTUs.
- Disable Unnecessary Services: Turn off any unused services or features that could be exploited.
- Monitoring & Alerts: Deploy continuous monitoring to detect anomalous activities and generate alerts for suspicious actions.
- Vendor Support: Engage with Red Lion support for guidance on best practices and updated security recommendations.
- Regular Audits: Conduct security audits to identify and address vulnerabilities proactively.
- Device Hardening: Apply best practices for device configuration to minimize attack surface.
- Incident Response Planning: Prepare a clear response plan for potential security breaches to ensure rapid containment and recovery.
Advance Your Cyber Knowledge
Discover cutting-edge developments in Emerging Tech and industry Insights.
Explore engineering-led approaches to digital security at IEEE Cybersecurity.
Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.
Cyberattacks-V1
