OTPulse

Delta Electronics Delta Industrial Automation COMMGR

Act NowCVSS 7.3ICS-CERT ICSA-18-172-01Jun 21, 2018
Delta ElectronicsManufacturing
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

A stack-based buffer overflow vulnerability in Delta Electronics COMMGR and related simulation software allows an attacker to send a specially crafted network packet to trigger remote code execution, application crash, or denial of service. The vulnerability affects COMMGR version 1.08 and earlier, DVPSimulator (EH2, EH3, ES2, SE, SS2 models), and AHSIM_5x0/5x1 simulation software. The affected software is commonly used in manufacturing environments for industrial automation control and communications management.

What this means
What could happen
An attacker who can reach your COMMGR server or simulation equipment over the network could run arbitrary commands on the device, potentially altering process settings, stopping production lines, or disrupting automation operations. The device could also be forced to crash, causing loss of communication with PLCs and field devices.
Who's at risk
This vulnerability affects manufacturing facilities that use Delta Electronics COMMGR for communications management, PLCs running DVPSimulator for program simulation and testing, and engineering workstations running AHSIM simulation software. Any organization using Delta EH-series, ES-series, or SS-series PLCs with these tools should review their exposure.
How it could be exploited
An attacker on the network sends a malicious packet crafted to overflow the stack buffer in COMMGR or the simulation software. If the overflow is successful, the attacker can inject and execute arbitrary code on the server. Alternatively, the malformed packet could crash the application, causing a denial-of-service condition that halts communication with connected industrial equipment.
Prerequisites
  • Network access to COMMGR port 502 or port 10002
  • No credentials required
  • No special configuration needed; vulnerability exists in default installation
remotely exploitableno authentication requiredlow complexityhigh EPSS score (78.2%)affects automation/process control
Exploitability
Likely to be exploited — EPSS score 78.2%
Metasploit module available — weaponized exploitView module ↗
Affected products (3)
1 with fix2 EOL
ProductAffected VersionsFix Status
COMMGR:≤ 1.081.09
DVPSimulator: EH2 EH3 ES2 SE SS2EH2 | EH3 | ES2 | SS2No fix (EOL)
AHSIM_5x0: AHSIM_5x1AHSIM 5x0 | AHSIM 5x1No fix (EOL)
Remediation & Mitigation
0/5
Do now
0/1
WORKAROUNDApply application whitelists to restrict traffic on ports 502 and 10002 to only trusted sources
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXUpgrade COMMGR to version 1.09 or later
Mitigations - no patch available
0/3
The following products have reached End of Life with no planned fix: DVPSimulator: EH2 EH3 ES2 SE SS2, AHSIM_5x0: AHSIM_5x1. Apply the following compensating controls:
HARDENINGPlace COMMGR and all control system equipment behind a firewall; do not expose to the Internet
HARDENINGIsolate the industrial automation network from the business network using network segmentation
HARDENINGIf remote access is needed, use a VPN; keep VPN software updated to the latest version
View full CISA ICS-CERT advisory
API: /api/v1/advisories/f185adb9-7723-4f8f-8364-5e077268e69d

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.