Resource exhaustion in TELEM-GWM and TELEM-GW6 - CVE-2018-10607

Detailed vulnerability description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to resource exhaustion. A remote attacker can create new connections to one or more IOAs, without closing them properly and cause a denial of service within the industrial process control channel.

How to mitigate CVE-2018-10607

In most cases, the vulnerability can be resolved by proper configuration:

• Using "other side IP" field in RTU configuration for every TCP/IP channel. This will minimize the risk of allowing unauthorized access and control over the communication channels (i.e., only trusted partners are allowed);
• Using secure VPN channels;
• Proper packet filtering by enabling firewall in RTU configuration. Note that the "interface" field of every communication channel must be properly set in RTU configuration when firewall is enabled.

Sources

• https://ics-cert.us-cert.gov/advisories/ICSA-18-142-01