CAREL PlantVisor Enhanced Authentication Bypass Vulnerability
Monitor7.5ICS-CERT ICSA-16-021-01Oct 24, 2016
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary
PlantVisor Enhanced contains an authentication bypass vulnerability that allows unauthenticated remote attackers to access the system. The vulnerability exists in the input validation mechanism (CWE-20) and affects all versions of the product. CAEL has indicated no fix is planned for this issue.
What this means
What could happen
An attacker can bypass authentication on PlantVisor Enhanced and gain unauthorized access to the system without valid credentials, allowing unauthorized monitoring, modification, or disconnection of connected industrial processes and equipment.
Who's at risk
Water treatment plant operators, municipal electric utilities, and HVAC/chiller plant operators who use CAREL PlantVisor Enhanced systems for remote monitoring and control of refrigeration, air handling, and process equipment. This affects any facility using PlantVisor Enhanced as their primary supervisory monitoring system.
How it could be exploited
An attacker sends specially crafted requests to PlantVisor Enhanced over the network that bypass authentication validation. The system accepts the request and grants access to sensitive functions, allowing the attacker to view or alter system configuration and control parameters.
Prerequisites
- Network access to PlantVisor Enhanced web interface or API (port likely 80/443 or proprietary)
- No credentials required
- Ability to send HTTP/HTTPS requests to the device
remotely exploitableno authentication requiredlow complexityno patch availableall versions affected
Exploitability
Low exploit probability (EPSS 0.3%)
Affected products (1)
ProductAffected VersionsFix Status
PlantVisorEnhanced: vers:all/*All versionsNo fix (EOL)
Remediation & Mitigation
0/5
Do now
0/3HARDENINGImplement network segmentation to restrict access to PlantVisor Enhanced. Limit connections to authorized engineering workstations only using firewall rules or VLANs.
WORKAROUNDDisable remote access to PlantVisor Enhanced if not required for operations. Restrict management and monitoring functions to local network access only.
WORKAROUNDImplement application-level access controls (web application firewall or reverse proxy) to require additional authentication before reaching PlantVisor Enhanced.
Mitigations - no patch available
0/2PlantVisorEnhanced: vers:all/* has reached End of Life. The vendor will not release a patch. Apply the following compensating controls:
HARDENINGMonitor PlantVisor Enhanced for unauthorized access attempts and configuration changes. Review audit logs regularly.
HARDENINGEvaluate replacement or retirement of PlantVisor Enhanced systems given the vendor has no patch planned. Plan for system upgrades or migration to supported alternatives with active security updates.
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/0c431cd6-958a-44f0-a4b4-f1836f37b3c2