Earlier this week, cybersecurity researchers at JSOF disclosed a set of 19 zero-day vulnerabilities, collectively known as Ripple20, present within a low-level TCP/IP software library used by hundreds of millions of devices, including numerous operational technology (OT) devices. The published vulnerabilities could allow an adversary to conduct denial-of-service attacks, and may possibly allow for remote code execution on affected devices.
Claroty assisted the research team at JSOF by providing consulting services and offering access to our extensive industrial control systems (ICS) lab environment, thus supporting efforts to map out which devices are susceptible to the Ripple20 vulnerabilities. To assist in the mitigation of these vulnerabilities, Claroty is the process of issuing a threat bundle, which will include signatures and CVE correlations based on all available vendor advisories.
The disclosed vulnerabilities affect the network stack of devices using the Treck embedded IP stack, much like the Urgent/11 vulnerabilities disclosed last year. And since this kind of attack is affecting the basic communication libraries on vulnerable devices, authentication is usually not required.
The full scope of products affected by the Ripple20 vulnerabilities is not yet clear, and public disclosures from the different vendors are expected in the coming weeks. According to JSOF, affected vendors range from small boutique shops to major corporations including HP, Schneider Electric, Intel, Rockwell Automation, Caterpillar, and Baxter, among others. More broadly, JSOF identifies the industrial, medical, retail, transportation, oil and gas, aviation, and government sectors as particularly vulnerable to the Ripple20 vulnerabilities, in addition to power grids, home appliances, networking devices, and other IoT-connected devices.
The following advisories have been issued for Ripple20:
Vendor advisories: Intel, HP, Schneider Electric, Caterpillar, B.Braun, Green Hills, Rockwell Automation, Cisco
The Claroty team will continue to monitor the situation, and when necessary, provide updates as new information becomes available. For more information about risk evaluation and mitigations, click here.
CWE-121 STACK-BASED BUFFER OVERFLOW:
Affected Vertiv products contain a stack based buffer overflow vulnerability. An attacker could exploit this vulnerability to gain code execution on the device.
Vertiv recommends users take the following actions:
CVSS v3: 9.8
CWE-288 AUTHENTICATION BYPASS USING AN ALTERNATE PATH OR CHANNEL:
Affected Vertiv products do not properly protect webserver functions that could allow an attacker to bypass authentication.
Vertiv recommends users take the following actions:
CVSS v3: 9.8
CWE 287: Improper Authentication
An Improper Authentication vulnerability exists in Danfoss AK-SM8xxA Series, resulting in an authentication bypass. Install the latest patch with number 4.2 to remediate this vulnerability. This flaw could enable an attacker to generate a web report that discloses sensitive information such as internal IP addresses, usernames, store names, and other sensitive information.e
CVSS v3: 8.2
CWE-798 USE OF HARD-CODED CREDENTIALS:
In Optigo Networks ONS NC600 versions 4.2.1-084 through 4.7.2-330, an attacker could connect with the device's ssh server and utilize the system's components to perform OS command executions.
Optigo Networks recommends users implement at least one of the following additional mitigations:
CVSS v3: 9.8
CWE-78 Improper Neutralization of Special Elements used in an OS Command:
A remote unauthenticated attacker who has bypassed authentication could execute arbitrary OS commands to disclose, tamper with, destroy or delete information in Mitsubishi Electric smartRTU, or cause a denial-of service condition on the product.
Mitsubishi Electric Europe B.V. recommends that users take note of the following mitigation measures to minimize the risk of exploiting this vulnerability:
CVSS v3: 9.8
