Earlier this week, cybersecurity researchers at JSOF disclosed a set of 19 zero-day vulnerabilities, collectively known as Ripple20, present within a low-level TCP/IP software library used by hundreds of millions of devices, including numerous operational technology (OT) devices. The published vulnerabilities could allow an adversary to conduct denial-of-service attacks, and may possibly allow for remote code execution on affected devices.
Claroty assisted the research team at JSOF by providing consulting services and offering access to our extensive industrial control systems (ICS) lab environment, thus supporting efforts to map out which devices are susceptible to the Ripple20 vulnerabilities. To assist in the mitigation of these vulnerabilities, Claroty is the process of issuing a threat bundle, which will include signatures and CVE correlations based on all available vendor advisories.
The disclosed vulnerabilities affect the network stack of devices using the Treck embedded IP stack, much like the Urgent/11 vulnerabilities disclosed last year. And since this kind of attack is affecting the basic communication libraries on vulnerable devices, authentication is usually not required.
The full scope of products affected by the Ripple20 vulnerabilities is not yet clear, and public disclosures from the different vendors are expected in the coming weeks. According to JSOF, affected vendors range from small boutique shops to major corporations including HP, Schneider Electric, Intel, Rockwell Automation, Caterpillar, and Baxter, among others. More broadly, JSOF identifies the industrial, medical, retail, transportation, oil and gas, aviation, and government sectors as particularly vulnerable to the Ripple20 vulnerabilities, in addition to power grids, home appliances, networking devices, and other IoT-connected devices.
The following advisories have been issued for Ripple20:
Vendor advisories: Intel, HP, Schneider Electric, Caterpillar, B.Braun, Green Hills, Rockwell Automation, Cisco
The Claroty team will continue to monitor the situation, and when necessary, provide updates as new information becomes available. For more information about risk evaluation and mitigations, click here.
CWE-547 USE OF HARD-CODED, SECURITY-RELEVANT CONSTANTS:
Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 are vulnerable to an attacker impersonating the web application service and mislead victim clients.
Optigo Networks recommends users to upgrade to the following:
CVSS v3: 7.5
CWE-288 AUTHENTICATION BYPASS USING AN ALTERNATE PATH OR CHANNEL:
Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 contain an exposed web management service that could allow an attacker to bypass authentication measures and gain controls over utilities within the products.
Optigo Networks recommends users to upgrade to the following:
CVSS v3: 9.8
CWE-547 USE OF HARD-CODED, SECURITY-RELEVANT CONSTANTS:
Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 contain a hard coded secret key. This could allow an attacker to generate valid JWT (JSON Web Token) sessions.
Optigo Networks recommends users to upgrade to the following:
CVSS v3: 7.5
CWE-912 HIDDEN FUNCTIONALITY:
The "update" binary in the firmware of the affected product sends attempts to mount to a hard-coded, routable IP address, bypassing existing device network settings to do so. The function triggers if the 'C' button is pressed at a specific time during the boot process. If an attacker is able to control or impersonate this IP address, they could upload and overwrite files on the device.
Per FDA recommendation, CISA recommends users remove any Contec CMS8000 devices from their networks.
If asset owners cannot remove the devices from their networks, users should block 202.114.4.0/24 from their networks, or block 202.114.4.119 and 202.114.4.120.
Please note that this device may be re-labeled and sold by resellers.
Read more here: Do the CONTEC CMS8000 Patient Monitors Contain a Chinese Backdoor? The Reality is More Complicated….
CVSS v3: 7.5
CWE-295 IMPROPER CERTIFICATE VALIDATION:
The affected product is vulnerable due to failure of the update mechanism to verify the update server's certificate which could allow an attacker to alter network traffic and carry out a machine-in-the-middle attack (MITM). An attacker could modify the server's response and deliver a malicious update to the user.
Medixant recommends users download the v2025.1 or later version of their software.
CVSS v3: 5.7
