Multiple vulnerabilities in ABB GATE-E1 and GATE-E2



Published: 2018-12-19
Risk Low
Patch available NO
Number of vulnerabilities 2
CVE-ID CVE-2018-18997
CVE-2018-18995
CWE-ID CWE-79
CWE-306
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe
GATE-E2
Hardware solutions / Firmware

GATE-E1
Hardware solutions / Firmware

Vendor ABB

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Cross-site scripting

EUVDB-ID: #VU16605

Risk: Low

CVSSv3.1: 5.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:U/RC:C]

CVE-ID: CVE-2018-18997

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

ABB will not be releasing updated firmware, as both GATE-E1 and GATE-E2 have reached end of life (EOL).  ABB recommends implementing defense-in-depth principles to minimize the risk that vulnerabilities are exploited.

  • Separate control system networks from other networks using firewall and managed switches that have minimal number of ports exposed. 
  • Physically protect control system from unauthorized personnel.
  • Portable computers and removable storage should be scanned for viruses before connected to control system.

Vulnerable software versions

GATE-E2: All versions

GATE-E1: All versions

External links

http://applied-risk.com/application/files/8615/4505/6727/Advisory_AR2018008_-_ABB_GATE_E1-E2_Multiple_Vulnerabilities_1.0.pdf


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Authentication bypass

EUVDB-ID: #VU16606

Risk: Low

CVSSv3.1: 9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:U/RC:C]

CVE-ID: CVE-2018-18995

CWE-ID: CWE-306 - Missing Authentication for Critical Function

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to bypass authentication.

The vulnerability exists due the devices do not allow authentication to be configured on administrative telnet or web interfaces. A remote attacker can bypass authentication to conduct device resets, read or modify registers, and change configuration settings such as IP addresses.

Mitigation

ABB will not be releasing updated firmware, as both GATE-E1 and GATE-E2 have reached end of life (EOL).  ABB recommends implementing defense-in-depth principles to minimize the risk that vulnerabilities are exploited.

  • Separate control system networks from other networks using firewall and managed switches that have minimal number of ports exposed. 
  • Physically protect control system from unauthorized personnel.
  • Portable computers and removable storage should be scanned for viruses before connected to control system.

Vulnerable software versions

GATE-E2: All versions

GATE-E1: All versions

External links

http://applied-risk.com/application/files/8615/4505/6727/Advisory_AR2018008_-_ABB_GATE_E1-E2_Multiple_Vulnerabilities_1.0.pdf


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###