CISA Warns of Critical Flaws Affecting Industrial Appliances from Advantech and Hitachi

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday released two Industrial Control Systems (ICS) advisories pertaining to severe flaws in Advantech R-SeeNet and Hitachi Energy APM Edge appliances.

This consists of three weaknesses in the R-SeeNet monitoring solution, successful exploitation of which “could result in an unauthorized attacker remotely deleting files on the system or allowing remote code execution.”

The list of issues, which affect R-SeeNet Versions 2.4.17 and prior, is as follows –

• CVE-2022-3385 and CVE-2022-3386 (CVSS scores: 9.8) – Two stack-based buffer overflow flaws that could lead to remote code execution
• CVE-2022-3387 (CVSS score: 6.5) – A path traversal flaw that could enable a remote attacker to delete arbitrary PDF files

Patches have been made available in version R-SeeNet version 2.4.21 released on September 30, 2022.

Also published by CISA is an update to a December 2021 advisory about multiple flaws in Hitachi Energy Transformer Asset Performance Management (APM) Edge products that could render them inaccessible.

The 29 vulnerabilities, collectively assigned a CVSS score of 8.2, stem from security holes in open source software components such as OpenSSL, LibSSL, libxml2, and GRUB2 bootloader. Users are recommended to update to APM Edge version 4.0 to remediate the bugs.

The twin alerts come less than a week after CISA published 25 ICS advisories on October 13, 2022, spanning several vulnerabilities across devices from Siemens, Hitachi Energy, and Mitsubishi Electric.

According to OT cybersecurity and asset monitoring company SynSaber, 681 ICS product vulnerabilities were reported via CISA in the first half of 2022, out of which 152 are rated Critical, 289 are rated High, and 2015 are rated Medium in Severity.

What’s more, 54 of the Critical/High-rated CVEs have no patch or any mitigation available from the vendors, accounting for 13% of the total reported flaws and remaining “forever-day vulnerabilities.”

“It’s important for asset owners and those defending critical infrastructure to understand when remediations are available, and how those remediations should be implemented and prioritized,” SynSaber said.