Operator File Upload Allows DoS in Industrial Control System

Executive Summary

A low-privileged remote attacker with operator access can upload arbitrary files via a REST endpoint meant for firmware updates. This allows storing attacker-controlled files persistently and may exhaust system resources, potentially causing Denial-of-Service.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for unauthorized firmware update requests or file uploads to the REST endpoint. Check for unexpected files in firmware storage directories and resource exhaustion on the device. Inspect logs for repeated failed authentication attempts or unusual MQTT broker access patterns.

Useful 0 Not Useful 0

Impact Analysis

An attacker could upload malicious files to the device, leading to persistent compromise. This might cause system crashes due to resource exhaustion, disrupting operations and potentially enabling further attacks.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows low-privileged attackers to upload arbitrary files, potentially leading to resource exhaustion and Denial-of-Service. This could disrupt operations handling sensitive data, impacting compliance with GDPR or HIPAA by compromising availability or integrity of personal health or user data.

Useful 0 Not Useful 0

Mitigation Strategies

Update firmware to the latest version immediately to prevent unauthorized file uploads and resource exhaustion. Restrict operator access to only necessary functions and monitor network traffic for unusual file uploads to the firmware update endpoint.

Useful 0 Not Useful 0