CVE-2022-2302: VDE-2022-030 | CERT@VDE

2022-07-11 12:00 (CEST) VDE-2022-030

Lenze: Vulnerability in the OPC-UA authentification connection in the firmware
Share: Email | Twitter

Published

2022-07-11 12:00 (CEST)

Last update

2022-07-11 12:02 (CEST)

Product(s)

Article No°

Product Name

Affected Version(s)

cabinet c520

V01.07.00.2757 < V01.08.01.3021

cabinet c550

V01.07.00.2757 < V01.08.01.3021

cabinet c750

V01.07.00.2757 < V01.08.01.3021

Summary

The machine controller of the cabinet series include an OPC-UA server which uses an user management to authenticate clients via anonymous or user/password authentication. If the user/password authentication is selected, password verification is skipped upon second login. As a result, cases occur in which users can establish communication without correct authentication. This vulnerability is not located in the OPC-UA protocol or server, but in the interface to the products firmware.

This Security Advisory is only relevant for the following use cases:

• the user management has been activated on the machine controller (is deactivated by default)

• the OPC-UA Server is used

• Data are transferred via a symbol configuration (is not available by default)

CVE ID

Severity

Weakness

Missing Critical Step in Authentication (CWE-304)

Summary

Multiple Lenze products of the cabinet series skip the password verification upon second login. After a user has been logged on to the device once, a remote attacker can get full access without knowledge of the password.

Source

Impact

The exploitation of the missing critical step in authentication may result in unauthorized use of the OPC-UA interface.

Solution

Mitigation

As part of a security strategy, Lenze SE recommends the following general defense measures to reduce the risk of exploits:

• Only use the products in a protected and controlled environment to minimize network impact and to ensure that they are inaccessible from outside.

• Use external firewalls to protect the automation system network and to separate it from other networks. Remark: One Measure should be to block port 4840 via the external firewall and open this port for authenticated access only.

• Use Virtual Private Networks (VPN) tunnels when remote access is required.

• Use IDS (Intrusion Detection Systems) where possible to detect anomalies in the network.

• Activate and use user administration and password functions.

• Use encrypted communication links.

• Restrict access to both the development tools and their projects and the products of the automation system by physical means, operating system functions, etc.

• Protect the development tool by using the latest virus detection solutions.

• Use of certificate-based communication via the message security modes Sign or Sign&Encrypt and trust of the corresponding client certificates on the machine controller by the OPC-UA server. This can reduce the risk of exploiting this vulnerability.

Remediation

Install version V01.08.01.3021, which solves the identified security vulnerability.

Reported by

CERT@VDE coordinated with LENZE