Security News > 2020 > February > Touch panels deployed in critical infrastructure vulnerable to remote attacks

Manufacturing facilities and processing centers using AutomationDirect C-more Touch Panels are advised to upgrade their firmware ASAP, as older versions contain a high-risk vulnerability that may allow attackers to get account information such as usernames and passwords, obscure or manipulate process data, and lock out access to the device.

Manufactured by US-based AutomationDirect, the vulnerable C-more Touch Panels EA9 series are human-machine interfaces capable of communicating with a wide variety of programmable logic controllers.

CVE-2020-6969, reported by Joel Langill of Amentum Mission Engineering & Resilience, is a vulnerability that could allow attackers "To unmask credentials and other sensitive information on 'unprotected' project files, which may allow them to remotely access the system and manipulate system configurations."

The vulnerability can be exploited remotely without authentication or user interaction, may affect confidentiality, integrity and availability of the system, and requires a low skill level to exploit.

Control system devices and/or systems should, in general, not be accessible from the internet, CISA recommends, and control system networks and remote devices should be located behind firewalls and isolated from the business network.

News URL

http://feedproxy.google.com/~r/HelpNetSecurity/~3/5XkMWjY2KtM/