Dangerous vulnerabilities in Emerson OpenEnterprise

Several dangerous vulnerabilities have been uncovered in Emerson’s OpenEnterprise SCADA Software (versions up to 3.3.4). By exploiting these vulnerabilities threat actors can gain access to OpenEnterprise configuration services or passwords for user accounts.

CVE-2020-10640 is the most dangerous vulnerability in this group and was given a maximum score of 10 points on the CVSS v.3 scale. This vulnerability is based on a lack of mandatory authorization for a critical function and can allow attackers to perform remote code execution or run arbitrary commands with system privileges.

The second problem, CVE-2020-10632, is caused by incorrect folder permissions and can lead to modifications in important configuration files causing system malfunctions or unpredictable behavior. This vulnerability has earned a base score of 8.8 on the CVSS v.3 scale.

CVE-2020-10636, the third and final vulnerability is due to incorrect encryption and allows threat actors to access user passwords. It received a score of 6.5 on the CVSS v.3 scale.

Emerson recommends all users to install OpenEnterprise 3.3, Service Pack 5 (3.3.5).

Sources: Kaspersky ICS CERT, ICS-CERT