OTPulse

MegaSys Computer Technologies Telenium Online Web Application (Update A)

Plan PatchCVSS 9.8ICS-CERT ICSA-24-263-04Sep 19, 2024
Oil & gas
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

Telenium Online Web Application versions 8.3 and earlier contain an input validation flaw (CWE-20) that allows attackers to inject arbitrary Perl code through a crafted HTTP request. Successful exploitation results in remote code execution with server privileges. The vulnerability affects all instances of the web-based interface used for monitoring and controlling oil and gas production systems. No public exploitation has been reported, but the high CVSS score and ease of exploitation make this a critical priority.

What this means
What could happen
An attacker could inject and execute arbitrary Perl code on the Telenium Online server through a crafted HTTP request, gaining complete control over the device and potentially disrupting or manipulating oil and gas operations that depend on it.
Who's at risk
Oil and gas operators using MegaSys Telenium Online Web Application for monitoring and control of production systems, particularly those with versions 8.3 or earlier. This includes any organization where the web interface provides access to SCADA systems, RTUs, or other critical control devices.
How it could be exploited
An attacker on the network sends a crafted HTTP request containing malicious Perl code to the Telenium Online Web Application. The application fails to validate the input, allowing the code to execute on the server with full privileges. This enables the attacker to run arbitrary commands, modify configuration, or crash the service.
Prerequisites
  • Network access to the Telenium Online Web Application (typically HTTP/HTTPS port 80 or 443)
  • No authentication required
remotely exploitableno authentication requiredlow complexitycritical CVSS score (9.8)high-impact code executionaffects control system visibility and potentially safety operations
Exploitability
Some exploitation risk — EPSS score 1.9%
Affected products (1)
ProductAffected VersionsFix Status
Telenium Online Web Application: <=8.3≤ 8.3v8.3.36 or v7.4.72
Remediation & Mitigation
0/5
Do now
0/1
WORKAROUNDIf patching cannot be completed immediately, disable the web/browser-based interface to the Telenium Online application until the patch is deployed
Schedule — requires maintenance window
0/3

Patching may require device reboot — plan for process interruption

HOTFIXUpdate Telenium Online Web Application to v8.3.36 (for version 8.x systems) or v7.4.72 (for version 7.x systems)
HARDENINGRestrict network access to the Telenium Online Web Application to only authorized engineering workstations and control network IPs using firewall rules
HARDENINGIf remote access to Telenium Online is required, use a VPN connection from a hardened jump server rather than exposing the application directly
Long-term hardening
0/1
HARDENINGIsolate the Telenium Online Web Application on a network segment behind the corporate firewall, separate from the business network and internet
View full CISA ICS-CERT advisory
API: /api/v1/advisories/3c836a28-2ba1-4cd8-8971-b868d3e14c35

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.