Security News > 2022 > November > High-Severity Flaw Reported in Critical System Used by Oil and Gas Companies

Cybersecurity researchers have disclosed details of a new vulnerability in a system used across oil and gas organizations that could be exploited by an attacker to inject and execute arbitrary code.

"Attackers can exploit this flaw to gain root access on an ABB flow computer, read and write files, and remotely execute code," industrial security company Claroty said in a report shared with The Hacker News.

Flow computers are special-purpose electronic instruments used by petrochemical manufacturers to interpret data from flow meters and calculate and record the volume of substances such as natural gas, crude oils, and other hydrocarbon fluids at a specific point in time.

These gas measurements are critical not only when it comes to process safety, but are also used as inputs when bulk liquid or gas products change hands between parties, making it imperative that the flow measurements are accurately captured.

In a nutshell, the vulnerability identified by Claroty is a path traversal flaw that exists in ABB's implementation of its proprietary Totalflow TCP protocol, which is utilized to remotely configure the computers.

By taking advantage of the shortcoming, a remote malicious actor could seize control of the devices and hamper their ability to properly record oil and gas flow rates.

News URL

https://thehackernews.com/2022/11/high-severity-flaw-reported-in-critical.html