OTPulse

IDEC CORPORATION WindLDR and WindO/I-NV4

MonitorCVSS 5.9ICS-CERT ICSA-24-263-03Sep 19, 2024
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityHigh
User InteractionNone needed
Summary

WindLDR versions 9.1.0 and earlier, and WindO/I-NV4 versions 3.0.1 and earlier, store sensitive information in cleartext. An attacker with network access could read this information to obtain credentials or configuration details. The vulnerability has high attack complexity and no known public exploitation has been reported.

What this means
What could happen
An attacker with network access to WindLDR or WindO/I-NV4 could read sensitive information stored in cleartext, such as credentials or configuration data, potentially enabling unauthorized access to control systems or process manipulation.
Who's at risk
IDEC WindLDR and WindO/I-NV4 are industrial software platforms used for PLC programming and HMI/SCADA visualization in manufacturing and process automation environments. This vulnerability affects organizations running these platforms for machinery control, process monitoring, or system configuration.
How it could be exploited
An attacker on the same network segment as WindLDR or WindO/I-NV4 can intercept or directly access files or memory containing sensitive information stored without encryption, extracting credentials or configuration details for further attacks.
Prerequisites
  • Network access to WindLDR or WindO/I-NV4 device
  • Device must be reachable from attacker's network segment
  • High attack complexity suggests specific conditions or knowledge required (details not disclosed in advisory)
Remotely exploitableNo authentication requiredSensitive information disclosureInformation stored in cleartextHigh attack complexity
Exploitability
Unlikely to be exploited — EPSS score 0.4%
Affected products (2)
2 with fix
ProductAffected VersionsFix Status
WindLDR: <=Ver.9.1.0≤ Ver.9.1.09.2.0
WindO/I-NV4: <=Ver.3.0.1≤ Ver.3.0.13.1.0
Remediation & Mitigation
0/5
Do now
0/2
HARDENINGIsolate WindLDR and WindO/I-NV4 from direct internet access; ensure they are only reachable from trusted internal networks behind firewalls
HARDENINGRequire VPN with current security updates for any remote access to WindLDR or WindO/I-NV4 systems
Schedule — requires maintenance window
0/2

Patching may require device reboot — plan for process interruption

HOTFIXUpdate WindLDR to version 9.2.0 or later
HOTFIXUpdate WindO/I-NV4 to version 3.1.0 or later
Long-term hardening
0/1
HARDENINGSegregate WindLDR and WindO/I-NV4 networks from business networks to limit lateral movement if credentials are compromised
View full CISA ICS-CERT advisory
API: /api/v1/advisories/38700076-4c1d-4d1a-be1e-731665dbc816

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.