OTPulse

PHOENIX CONTACT: addressing Meltdown and Spectre vulnerabilities

Act NowCVSS 5.6VDE-2018-003Mar 23, 2018
Phoenix Contact
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityHigh
User InteractionNone needed
Summary

Meltdown and Spectre CPU design flaws affect a broad range of Phoenix Contact industrial PCs and HMIs powered by Intel, AMD, or ARM processors. These vulnerabilities allow malicious software running on the device to read sensitive data from system memory by exploiting the CPU's speculative execution and cache behavior. The vendor has stated no firmware patches will be released for these products. Mitigation depends on whether the device runs an upgradable operating system (typically Windows) that can receive OS-level security patches.

What this means
What could happen
An attacker with local access to these industrial computers could exploit CPU design flaws to read sensitive data from memory, potentially accessing process control parameters, credentials, or system information. The impact depends on what data resides in memory and how tightly the device is isolated from untrusted users.
Who's at risk
Water utilities, electric utilities, and other critical infrastructure operators using Phoenix Contact industrial PCs and HMIs (including AXC, BL, DL, EL, TP, TPM, VALUELINE, VL, and WP series) for process automation and control should assess their exposure. These devices are commonly used in control room workstations, data acquisition systems, and industrial computing applications.
How it could be exploited
An attacker must run specially crafted software directly on the affected device (Meltdown/Spectre exploits require local code execution). This requires either local user access or the ability to run malicious software on the device. The exploit reads data from the CPU cache or speculative execution, bypassing normal memory isolation.
Prerequisites
  • Local code execution capability (unprivileged user level)
  • Access to run software on the device
  • No defense: vendor states no patch will be provided
No patch available (vendor will not fix)Requires local code executionAffects Intel, AMD, and ARM CPUs across a broad product lineMedium CVSS but information disclosure could expose control system parameters
Exploitability
Likely to be exploited — EPSS score 94.3%
Public Proof-of-Concept (PoC) on GitHub (10 repositories)
Affected products (57)
57 pending
ProductAffected VersionsFix Status
AXC 3051All versionsNo fix yet
AXC F 2152All versionsNo fix yet
BL2 BPC 1000All versionsNo fix yet
BL2 BPC 2000All versionsNo fix yet
BL2 BPC 7000All versionsNo fix yet
Remediation & Mitigation
0/4
Do now
0/1
HARDENINGRestrict physical and network access to these devices to authorized personnel only; prevent installation of untrusted software
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXInstall the latest operating system security updates if the device runs Windows or another upgradable OS, and test for performance impact before production deployment
Long-term hardening
0/2
HARDENINGSegment these devices on isolated networks or VLANs to limit the risk of remote attackers gaining local access
HARDENINGEvaluate whether devices can be isolated from user-facing networks and internet connectivity
View full CERT@VDE advisory
API: /api/v1/advisories/9649e3ac-f46b-4946-831d-32e3e1e7ba65

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.