Instantel Micromate (Update A)
Act Now9.8ICS-CERT ICSA-25-148-04May 29, 2025
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary
Instantel Micromate versions before 11.0BD and 11.0CB contain an authentication bypass vulnerability (CWE-306) in the configuration port. An unauthenticated attacker can access the port and execute commands to modify device settings or disable vibration monitoring functionality. The vulnerability requires only network access with no user interaction needed.
What this means
What could happen
An unauthenticated attacker with network access to the device could execute commands and modify the Micromate's configuration, potentially disrupting vibration monitoring and blasting operations at mining or construction sites.
Who's at risk
Mining operations, construction companies, and blasting contractors using Instantel Micromate vibration monitoring equipment for blast safety and seismic monitoring. The device is typically deployed on job sites to detect ground vibration from explosions and construction activities.
How it could be exploited
An attacker on the same network (or the internet if the device is exposed) sends requests to the Micromate's configuration port without providing credentials. The device fails to authenticate the request and allows command execution. This could let the attacker change settings, disable monitoring, or trigger false alarms.
Prerequisites
- Network access to the Micromate device configuration port
- No credentials required
Remotely exploitableNo authentication requiredLow complexityCritical CVSS score (9.8)Affects safety-critical monitoring
Exploitability
Low exploit probability (EPSS 0.4%)
Affected products (1)
ProductAffected VersionsFix Status
Micromate: <11.0BD_and_11.0CB<11.0BD and 11.0CB11.0BD, 11.0CB or later
Remediation & Mitigation
0/4
Do now
0/2WORKAROUNDImplement IP address whitelisting on the Micromate to allow only approved monitoring stations and administrative workstations
HARDENINGIsolate the Micromate and all blasting/vibration monitoring equipment behind a firewall; do not expose to the internet
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXUpdate Micromate firmware to the patched version available from Instantel's website
Long-term hardening
0/1HARDENINGMove Micromate devices off business networks onto a dedicated, segmented control system network
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/b363ad8c-a83b-4c39-97f5-d2312d813122