OTPulse
FeedAboutContact

Pangea Communications Internet FAX ATA

Monitor7.5ICS-CERT ICSA-19-045-01Feb 14, 2019
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

The Pangea Communications Internet FAX ATA device (version 3.1.8 and earlier) contains a vulnerability that allows unauthenticated remote attackers to cause a denial-of-service condition. Successful exploitation causes the device to reboot repeatedly, disrupting fax communications. Pangea Communications has stated that a patch has been deployed and is available through their support contact.

What this means
What could happen
An attacker can crash the Internet FAX ATA device remotely, causing it to reboot repeatedly and disrupting fax-based communications that may be used for alarms, notifications, or operational alerts in critical infrastructure.
Who's at risk
Water and utility operators who rely on fax-based communication for emergency notifications, work orders, or alerts should be concerned. This affects any facility using Pangea Communications Internet FAX ATA devices (version 3.1.8 or earlier) for mission-critical fax operations.
How it could be exploited
An attacker on the network can send a specially crafted network packet to the FAX ATA device without authentication, triggering a denial-of-service condition that causes continuous reboots and prevents normal fax operations.
Prerequisites
  • Network access to the Internet FAX ATA device
  • No authentication required
Remotely exploitableNo authentication requiredLow complexity attackNo patch available for older versionsAffects communications infrastructure
Exploitability
Low exploit probability (EPSS 1.0%)
Affected products (1)
ProductAffected VersionsFix Status
Internet FAX ATA:≤ 3.1.8No fix yet
Remediation & Mitigation
0/3
Do now
0/1
WORKAROUNDRestrict network access to the Internet FAX ATA device using firewall rules—only allow fax traffic from known, trusted sources
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXContact Pangea Communications support to obtain and deploy the patch that has been made available to users
Long-term hardening
0/1
HARDENINGImplement network segmentation to isolate the FAX ATA device from untrusted networks if it is currently exposed to the internet or untrusted subnets
View full CISA ICS-CERT advisory
↑↓ Navigate · Esc Close
API: /api/v1/advisories/c1b9147a-2fce-476e-82d4-01ab00a37f88