Authentication bypass in TELEM-GWM and TELEM-GW6 - CVE-2018-10603

Vulnerability details

The vulnerability allows a remote attacker to bypass authentication on the target system.

The vulnerability exists due to the RTU does not perform authentication of IEC-104 control commands. A remote attacker can bypass authentication and which may allow a rogue node a remote control of the industrial process.

Successful exploitation of this vulnerability may result in system compromise.

Affected software

How to mitigate CVE-2018-10603

In most cases, the vulnerability can be resolved by proper configuration:

• Using "other side IP" field in RTU configuration for every TCP/IP channel. This will minimize the risk of allowing unauthorized access and control over the communication channels (i.e., only trusted partners are allowed);
• Using secure VPN channels;
• Proper packet filtering by enabling firewall in RTU configuration. Note that the "interface" field of every communication channel must be properly set in RTU configuration when firewall is enabled.

External References

• https://ics-cert.us-cert.gov/advisories/ICSA-18-142-01

Related Security Bulletins

• Multiple vulnerabilities in Martem TELEM-GW6/GWM
• OpenSUSE Linux update for python3
• Red Hat update for python