Full Report
Researchers at Palo Alto Networks have uncovered multiple vulnerabilities within a Supervisory Control and Data Acquisition (SCADA) system,... The post Palo Alto detects critical vulnerabilities in ICONICS SCADA systems, urges patching and remediation appeared first on Industrial Cyber.
Analysis Summary
# Vulnerability: Multiple Vulnerabilities in ICONICS Suite Leading to Privilege Escalation, DoS, and System Compromise
## CVE Details
- CVE ID: Not explicitly listed in the provided text.
- CVSS Score: Not explicitly listed.
- CWE: Multiple potential CWEs, including DLL Hijacking and Improper Access Control/Permissions Issues.
## Affected Systems
- Products: ICONICS Suite (SCADA system), including components like GENESIS32 (with GenBroker32) and GENESIS64 (when GenBroker32 is inadvertently installed).
- Versions: Versions 10.97.3 and earlier for Microsoft Windows platforms. Specifically noted in versions 10.97.2 and 10.97.3.
- Configurations: Vulnerabilities are triggered when the vulnerable 32-bit communications utility (`GenBroker32`) is installed, often inadvertently by selecting an unlabeled "GenBroker" option during or after installing GENESIS64, or through issues within the integrated, deprecated Derdack Message Master SMS SDK.
## Vulnerability Description
The ICONICS Suite contains several vulnerabilities that permit privilege escalation, Denial of Service (DoS), and potentially full system compromise.
Key mechanisms include:
1. **DLL Hijacking:** Attackers can substitute legitimate ICONICS DLL files with malicious versions, potentially leading to Arbitrary Code Execution (ACE) and system compromise by abusing the Windows DLL search order.
2. **Improper Directory Permissions:** Inadvertent installation of the 32-bit utility (`GenBroker32`) causes permission changes in a critical directory containing binaries and configuration files, resulting in overly permissive settings that grant system-wide user access. This enables attackers to manipulate critical files or replace binaries.
3. **Outdated SDK Component:** The AlarmWorX MMX module uses a deprecated and unsupported SMS SDK (Derdack Message Master SMS SDK v2.0), exposing it to underlying vulnerabilities that allow ACE, Persistence, and Privilege Escalation.
## Exploitation
- Status: Not explicitly stated as exploited in the wild, but research findings indicate a high potential for exploitation. PoC is implied through the technical detail provided regarding DLL hijacking and permission abuse.
- Complexity: Medium (Requires specific installation state or target application interaction, but DLL hijacking can be low complexity once prerequisites are met in the vulnerable process environment).
- Attack Vector: Network (Remote access exists for dozens of internet-facing servers), Local.
## Impact
- Confidentiality: High (Potential for unauthorized access and data manipulation).
- Integrity: High (Ability to modify configuration settings, replace binaries, and execute arbitrary code).
- Availability: Medium/High (Potential for Denial of Service).
## Remediation
### Patches
- Patches were released by ICONICS in collaboration with Palo Alto Networks security researchers in 2024 to address some of these vulnerabilities. Specific patch versions are not listed in the summary text.
### Workarounds
- Security advisories were issued with specific workarounds for remaining issues.
- **Mitigation for GenBroker:** Ensure only the non-vulnerable `GenBroker64` utility is used. Avoid installing the unlabeled "GenBroker" option if GENESIS64 is already present; verify that `GenBroker32` is not installed on top of GENESIS64 installations.
- **Mitigation for SDK:** Update or remove modules relying on the deprecated Derdack Message Master SMS SDK v2.0, if possible.
## Detection
- Indicators of compromise: Unexpected modification of ICONICS configuration files or binaries; execution of unknown processes originating from directories hosting ICONICS DLLs; unexpected network activity or privilege changes related to system users accessing critical OT application folders.
- Detection methods and tools: Monitoring file system changes in sensitive application directories; inspecting running processes for unauthorized DLL loading; EDR/monitoring systems should specifically look for evidence of phantom DLL loading patterns.
## References
- Vendor advisories: ICONICS Security Team Advisories (2024).
- Relevant links:
- hxxps://unit42.paloaltonetworks.com/vulnerabilities-in-iconics-software-suite/