Authentication bypass in TELEM-GWM and TELEM-GW6 - CVE-2018-10603

Detailed vulnerability description

The vulnerability allows a remote attacker to bypass authentication on the target system.

The vulnerability exists due to the RTU does not perform authentication of IEC-104 control commands. A remote attacker can bypass authentication and which may allow a rogue node a remote control of the industrial process.

Successful exploitation of this vulnerability may result in system compromise.

How to mitigate CVE-2018-10603

In most cases, the vulnerability can be resolved by proper configuration:

• Using "other side IP" field in RTU configuration for every TCP/IP channel. This will minimize the risk of allowing unauthorized access and control over the communication channels (i.e., only trusted partners are allowed);
• Using secure VPN channels;
• Proper packet filtering by enabling firewall in RTU configuration. Note that the "interface" field of every communication channel must be properly set in RTU configuration when firewall is enabled.

Sources

• https://ics-cert.us-cert.gov/advisories/ICSA-18-142-01