Triangle Microworks Libraries
Monitor7.5ICS-CERT ICSA-22-249-01Sep 6, 2022
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary
Triangle Microworks protocol libraries contain a vulnerability (CWE-824) that can be exploited to cause a denial-of-service condition. Affected are: IEC 60870-6 C++ library version 4.4.3 and earlier, IEC 61850 C language library version 11.2.0 and earlier, and IEC 61850 C++/C#/Java libraries version 5.0.1 and earlier. No vendor patch is currently available. The vulnerability can be triggered remotely by sending malformed protocol messages without authentication.
What this means
What could happen
An attacker could cause a denial-of-service condition on servers or clients using the affected Triangle Microworks protocol libraries, disrupting communication between control systems and potentially interrupting remote monitoring or control of critical infrastructure.
Who's at risk
Operators of SCADA, RTU, and IEC 61850-based protection or communication systems that rely on Triangle Microworks libraries for IEC 60870-6 (ICCP/Tase.2) or IEC 61850 protocol communication, including electric utilities, water authorities, and substations. Affects any C, C++, C#, or Java-based client or server application using these libraries.
How it could be exploited
An attacker with network access to a device or application using the vulnerable library could send specially crafted protocol messages (IEC 60870-6, IEC 61850) to trigger a crash or hang, rendering the service unavailable. The attack requires only network-level access with no authentication.
Prerequisites
- Network access to a device or application using the affected TMW library
- Device or application must be running a vulnerable version of the library (IEC 60870-6 C++ <= 4.4.3, IEC 61850 C <= 11.2.0, or IEC 61850 C++/C#/Java <= 5.0.1)
Remotely exploitableNo authentication requiredLow attack complexityNo patch availableDenial-of-service impact
Exploitability
Low exploit probability (EPSS 0.1%)
Affected products (3)
3 pending
ProductAffected VersionsFix Status
TMW Library IEC 60870 - 6 (ICCP/Tase.2) -Any client or server using a C++ language library with a:≤ 4.4.3No fix yet
TMW Library IEC 61850 - Any client or server using the C language library with a:≤ 11.2.0No fix yet
TMW Library IEC 61850 - Any client or server using the C++ C# or Java language library with a:≤ 5.0.1No fix yet
Remediation & Mitigation
0/4
Do now
0/1WORKAROUNDContact Triangle Microworks Support for mitigation guidance and strategies
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HARDENINGIf remote access is required, implement secure methods such as VPNs with the most current version available
Long-term hardening
0/2HARDENINGMinimize network exposure of control system devices by ensuring they are not accessible from the Internet
HARDENINGPlace control system networks and remote devices behind firewalls and isolate them from business networks
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/f394b486-b296-40ab-9474-174797d8d3c8