Santamarta found multiple hard-coded credentials in the firmware that enable access to the following services:

• Telnet port—May allow remote attackers the ability to view the operation of the module’s firmware, cause a denial of service, modify the memory of the module and execute arbitrary code.
   
• Windriver Debug port—Used for development; may allow remote attackers to view the operation of the module’s firmware, cause a denial of service, modify the memory of the module and execute arbitrary code.
   
• FTP service—May allow an attacker to modify the module website, download and run custom firmware and modify the http passwords.

ICS-CERT is currently coordinating with Schneider Electric to develop mitigations. Additional information regarding the impact and mitigations will be issued as it becomes available.

Schneider Electric has created a fix for the Telnet and Windriver debug port vulnerabilities for the BMXNOE0100 and 140NOE77101 modules, which will be published on the Schneider website. This fix removes the Telnet and Windriver services from the modules. Organizations need to evaluate the impact of removing these services prior to applying this fix. ICS-CERT will provide additional information as mitigations become available for other identified vulnerabilities.

ICS-CERT recommends that users take defensive measures to minimize the risk of exploitation of these vulnerabilities. These include:

1. Minimize network exposure for all control system devices. Control system devices should not directly face the Internet.

2. Locate control system networks and devices behind firewalls, and isolate them from the business network.

3. If remote access is required, employ secure methods, such as Virtual Private Networks (VPNs), recognizing that VPN is only as secure as the connected devices.

ICS-CERT reminds organizations to perform proper impact analysis and risk assessment prior to taking defensive measures.

Visit the ICS-CERT website or Schneider Electric for more information.