7-Technologies IGSS Denial of Service (Update A)

Overview

ICS-CERT has become aware of multiple denial-of-service (DoS) vulnerabilities in the 7-Technologies  (7T) Interactive Graphical SCADA System (IGSS) supervisory control and data acquisition (SCADA) human-machine interface (HMI) application. All vulnerabilities are remotely exploitable.

7T has developed patches that resolve the reported vulnerabilities in the affected versions.

--------- Begin Update A Part 1 of 3 ----------

ICS-CERT and independent researcher Joel Langill have validated the patches.

--------- End Update A Part 1 of 3 ----------

Affected Products

--------- Begin Update A Part 2 of 3 ----------

The vulnerabilities do not affect 7T IGSS SCADA HMI Version 6.
The vulnerabilities affect 7T IGSS SCADA HMI Version 7 prior to Revision 10033.
The vulnerabilities affect 7T IGSS SCADA HMI Version 8 prior to Revision 11102.
The vulnerabilities affect 7T IGSS SCADA HMI Version 9 prior to Revision 11143.

--------- End Update A Part 2 of 3 ----------

Impact

Successful exploitation of the reported vulnerabilities can allow an attacker to perform a remote DoS attack against the 7T data server. This action can result in adverse application conditions and ultimately impact the production environment on which the SCADA system is used.

Impact to individual organizations depends on many factors that are unique to each organization. ICS-CERT recommends that organizations evaluate the impact of these vulnerabilities based on the environment, architecture, and product implementation.

Background

7T, based in Denmark, creates monitoring and control systems that are primarily used in the United States, Europe, and South Asia. According to the 7T website, IGSS has been deployed in over 28,000 industrial plants in 50 countries worldwide.

7T IGSS HMI is used to control and monitor programmable logic controllers in industrial processes across multiple sectors including manufacturing, energy (oil and gas), and water.

Vulnerability Characterization

Denial of Service Vulnerability Overview

The DoS vulnerability occurs in the IGSSdataServer service on Port 12401/TCP and in the dc.exe service
on Port 12397/TCP.

Stack-Based Buffer Overflow Vulnerability Details

Exploitability

The DoS vulnerabilities reported can be remotely exploited by sending specially crafted packets to the vulnerable IGSSdataServer service or to the dc.exe service.

Existence of Exploit

Exploit code is publicly available for these vulnerabilities.

Difficulty

These vulnerabilities require moderate skills to exploit.

Mitigation

ICS-CERT recommends that customers of 7T IGSS software take the following mitigation steps:

--------- Begin Update A Part 3 of 3 ----------

Download and run the “IGSS Update” to install the corresponding version patch on the system:

• Version 7
• Version 8
• Version 9

--------- End Update A Part 3 of 3 ----------

Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to ICS-CERT for tracking and correlation against other incidents. ICS-CERT reminds organizations to perform proper impact analysis and risk assessment prior to taking
defensive measures.

The Control Systems Security Program (CSSP) also provides a section for control system security recommended practices on the CSSP page of the US-CERT website. Several recommended practices are available for reading or download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

• 7-Technologies