OTPulse
FeedAboutContact

Infinite Automation Systems Mango Automation Vulnerabilities (Update A)

Act Now6.3ICS-CERT ICSA-15-300-02AJul 30, 2015
Attack VectorNetwork
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

Infinite Automation Systems Mango Automation versions 2.5.0 through 2.6.0 contain multiple vulnerabilities allowing authenticated attackers to upload arbitrary files (CWE-434), execute operating system commands (CWE-78), read sensitive information (CWE-215), inject SQL queries (CWE-89), bypass access controls (CWE-352), inject malicious scripts into web pages (CWE-79), and infer timing information to enumerate user data (CWE-204). A malicious user or an attacker who has compromised a low-privileged account can exploit these issues to gain complete control of the Mango Automation server, alter automation rules, manipulate sensor data, or disable monitoring systems.

What this means
What could happen
An authenticated user could upload malicious files, execute arbitrary commands on the Mango Automation server, bypass access controls, inject SQL or web script code, and read sensitive data from the system. This could allow an attacker to manipulate automation workflows, alter process parameters, or disable monitoring capabilities.
Who's at risk
Mango Automation users who run versions 2.6.0 or earlier should upgrade immediately. This affects industrial facilities, utilities, and building automation systems that rely on Mango Automation for SCADA/HMI functionality, data logging, and process control workflows. Water authorities, electric utilities, and manufacturing plants using Mango Automation for real-time monitoring and automation are at risk.
How it could be exploited
An attacker with valid Mango Automation credentials authenticates to the web interface and exploits file upload functionality (CWE-434) to upload a malicious script. The server executes this script via OS command injection (CWE-78), allowing arbitrary code execution. Alternatively, the attacker could inject SQL commands (CWE-89) into application queries or inject JavaScript into the web interface (CWE-79) to manipulate data or steal session tokens from other users.
Prerequisites
  • <parameter name="item">Valid Mango Automation user account with login credentials
<parameter name="item">Remotely exploitable via web interface
Exploitability
High exploit probability (EPSS 12.8%)
Affected products (2)
2 with fix
ProductAffected VersionsFix Status
Mango Automation: >=2.5.0|<=2.6.0_beta≥ 2.5.0|≤ 2.6.0 beta2.7.0 or later
Mango Automation: <2.7.0<2.7.02.7.0 or later
Remediation & Mitigation

CISA recommends users take defensive measures to minimize the risk of exploitation.

View full CISA ICS-CERT advisory
↑↓ Navigate · Esc Close
API: /api/v1/advisories/556bc96b-1677-426b-ae44-41288acc1aee