SIMPlight SCADA Software is suffering from an uncontrolled search path element vulnerability and the company has not responded to requests to mitigate the vulnerability, according to a report with ICS-CERT.
SCADA Software version 18.104.22.168 and prior, which is software for building management systems and automated facilities suffer from the issue, discovered by Karn Ganeshen.
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code.
No known public exploits specifically target this vulnerability. This vulnerability is not remotely exploitable. However, an attacker with low skill level could leverage the vulnerability.
The uncontrolled search path element vulnerability has been identified, which may allow an attacker to place a malicious DLL file within the search path resulting in execution of arbitrary code.
CVE-2017-9661 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 7.0.
The product sees action in the chemical, commercial facilities, critical manufacturing, defense industrial base, energy, food and agriculture, government facilities, healthcare and public health, nuclear reactors, materials, and waste industries.
Russia-based SIMPlight has not responded to requests to work with NCCIC/ICS-CERT to mitigate this vulnerability, said ICS-CERT officials.
ICS-CERT recommends users take defensive measures to minimize the risk of exploitation of this vulnerabilities. Users should:
• Minimize network exposure for all control system devices and/or systems, and ensure that they are not accessible from the Internet.
• Locate control system networks and remote devices behind firewalls, and isolate them from the business network.
• When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing that VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize that VPN is only as secure as the connected devices.