Experts Reveal Significant Security Weaknesses in Industrial MMS Protocol Libraries
Insights have surfaced about various security weaknesses in two versions of the Manufacturing Message Specification (MMS) protocol that, if exploited successfully, could cause significant repercussions in industrial settings.
“The vulnerabilities could potentially lead to the crashing of an industrial device or, in certain situations, facilitate remote code execution,” emphasized Claroty analysts Mashav Sapir and Vera Mens in a recent examination.
MMS is an OSI application layer messaging protocol that enables remote supervision and control of industrial devices by exchanging control information in a way that is independent of specific applications.
It enables communication between smart electronic devices (IEDs) and supervisory control and data acquisition (SCADA) systems or programmable logic controllers (PLCs).
The five deficiencies identified by the operational technology security firm affect MZ Automation’s libIEC61850 library and Triangle MicroWorks’ TMW IEC 61850 library, and were addressed in September and October 2022 after responsible disclosure –
- CVE-2022-2970 (CVSS score: 10.0) – A stack-based buffer overflow vulnerability in libIEC61850 that could result in a crash or remote code execution
- CVE-2022-2971 (CVSS score: 8.6) – A type confusion vulnerability in libIEC61850 that might permit a server crash through a malicious payload
- CVE-2022-2972 (CVSS score: 10.0) – A stack-based buffer overflow vulnerability in libIEC61850 that could result in a crash or remote code execution
- CVE-2022-2973 (CVSS score: 8.6) – A null pointer deference vulnerability that could cause a server crash
- CVE-2022-38138 (CVSS score:7.5) – An access of uninitialized pointer vulnerability allowing an attacker to trigger a denial-of-service (DoS) scenario
Claroty’s assessment also revealed that Siemens SIPROTEC 5 IED depended on an outdated version of SISCO’s MMS-EASE stack for MMS support, which is vulnerable to a DoS scenario via a specially crafted packet (CVE-2015-6574, CVSS score: 7.5).
The German firm has subsequently updated its firmware with an upgraded version of the protocol stack as of December 2022, as per an advisory released by the U.S. Cybersecurity and Infrastructure Security Agency (CISA).
The study underscores the “disparity between the security requirements of modern technology and the outdated, difficult-to-replace protocols,” Claroty noted, directing vendors to adhere to security recommendations issued by CISA.
The public disclosure follows a few weeks after Nozomi Networks highlighted two vulnerabilities in the reference implementation of Espressif’s ESP-NOW wireless protocol (CVE-2024-42483 and CVE-2024-42484) that could result in replay attacks and lead to a DoS situation.
“Depending on the target system, this vulnerability [CVE-2024-42483] could have far-reaching consequences,” it mentioned. “ESP-NOW is utilized in security systems like building alarms, enabling them to communicate with motion sensors.”
“In an actual scenario, an attacker could exploit this vulnerability to replay a previously intercepted valid ‘OFF’ command, thereby deactivating a motion sensor at their discretion.”
Alternatively, the utilization of ESP-NOW in remote door openers, such as automatic gates and garage doors, could be utilized to intercept an “OPEN” command and replay it later to achieve unauthorized access to buildings.
Previous to this, in August, Nozomi Networks also highlighted a set of unresolved 37 vulnerabilities in the OpenFlow libfluid_msg parsing library, collectively branded FluidFaults, which a malicious actor could exploit to trigger crashes in Software-Defined Networking (SDN) applications.
“A threat actor with visibility into an OpenFlow controller/forwarder can send a malevolent OpenFlow network packet that results in a denial-of-service (DoS) assault,” the firm stated.
Recently, security weaknesses have also been unearthed in Beckhoff Automation’s TwinCAT/BSD operating system that could expose PLCs to logic tampering, DoS attacks, and even command execution with root privileges on the controller.
About Author
