Multiple vulnerabilities in Schneider Electric PLC Simulator for EcoStruxure Control Expert

1) Improper Check for Unusual or Exceptional Conditions

EUVDB-ID: #VU48363

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-7538

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation. A remote attacker can send a specially crafted request over Modbus and cause denial of service condition.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

PLC Simulator for EcoStruxure Control Expert: All versions

PLC Simulator for Unity Pro: All versions

EcoStruxure Control Expert: before 15.0

External links

http://ics-cert.us-cert.gov/advisories/icsa-20-315-03

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Download of code without integrity check

EUVDB-ID: #VU48965

Risk: Medium

CVSSv3.1: 7.1 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-28213

CWE-ID: CWE-494 - Download of Code Without Integrity Check

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the affected system

The vulnerability exists due to software does not perform software integrity check when downloading updates. A remote authenticated attacker can send specially crafted requests over Modbus and execute arbitrary commands on the target system. 

Mitigation

Install updates from vendor's website.

Vulnerable software versions

PLC Simulator for EcoStruxure Control Expert: 14.1

PLC Simulator for Unity Pro: All versions

EcoStruxure Control Expert: before 15.0

External links

http://www.se.com/ww/en/download/document/SEVD-2020-315-07

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Improper Restriction of Excessive Authentication Attempts

EUVDB-ID: #VU48964

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-28212

CWE-ID: CWE-307 - Improper Restriction of Excessive Authentication Attempts

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to the system.

The vulnerability exists due to the authentication mechanism has no brute-force prevention. A remote attacker can launch a brute-force authentication attack and cause unauthorized command execution.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

PLC Simulator for EcoStruxure Control Expert: 14.1

PLC Simulator for Unity Pro: All versions

EcoStruxure Control Expert: before 15.0

External links

http://www.se.com/ww/en/download/document/SEVD-2020-315-07

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Improper Authorization

EUVDB-ID: #VU48963

Risk: Low

CVSSv3.1: 6.4 [CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-28211

CWE-ID: CWE-285 - Improper Authorization

Exploit availability: No

Description

The vulnerability allows a local user to bypass authorization checks.

The vulnerability exists due to improper authorization check. A local administrator can bypass authentication when overwriting memory using a debugger.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

PLC Simulator for EcoStruxure Control Expert: 14.1

PLC Simulator for Unity Pro: All versions

EcoStruxure Control Expert: before 15.0

External links

http://www.se.com/ww/en/download/document/SEVD-2020-315-07

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Stack-based buffer overflow

EUVDB-ID: #VU48961

Risk: High

CVSSv3.1: 8.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-7559

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the Modbus message-processing functionality. A remote unauthenticated attacker can send a specially crafted request, trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

PLC Simulator for EcoStruxure Control Expert: 14.1

EcoStruxure Control Expert: before 15.0

External links

http://www.se.com/ww/en/download/document/SEVD-2020-315-07
http://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1140

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.