Security News > 2020 > July > Critical Bugs in Utilities VPNs Could Cause Physical Damage

Remote code-execution vulnerabilities in virtual private network products could impact the physical functioning of critical infrastructure in the oil and gas, water and electric utilities space, according to researchers.

Researchers at Claroty found that VPNs used to provide remote access to operational technology networks in industrial systems are vulnerable to an array of security bugs, which could give an attacker direct access to field devices and cause physical damage or shut-downs.

In addition to the critical bug, other flaws found in GateManager include CVE-2020-14508, an off-by-one error, which may allow an attacker to remotely execute arbitrary code or cause a denial-of-service condition.

Last week, the U.S. National Security Agency and the Cybersecurity and Infrastructure Security Agency issued an alert warning that cybercriminals could be targeting critical infrastructure across the U.S. And separately, ICS-CERT issued an advisory on a critical security bug in the Schneider Electric Triconex TriStation and Tricon Communication Module.

The researchers added, "Denial-of-service attacks on these components of the enterprise infrastructure could potentially emerge as a new tactic used by financially motivated attackers."

News URL

https://threatpost.com/critical-bugs-utilities-vpns-physical-damage/157835/