VDE-2022-030
Vulnerability from csaf_lenzese - Published: 2022-07-11 10:00 - Updated: 2022-07-11 10:00Summary
Lenze: Vulnerability in the OPC-UA authentification connection in the firmware
Notes
Summary: The machine controller of the cabinet series include an OPC-UA server which uses an user management to authenticate clients via anonymous or user/password authentication. If the user/password authentication is selected, password verification is skipped upon second login. As a result, cases occur in which users can establish communication without correct authentication. This vulnerability is not located in the OPC-UA protocol or server, but in the interface to the products firmware.
This Security Advisory is only relevant for the following use cases:
• the user management has been activated on the machine controller (is deactivated by default)
• the OPC-UA Server is used
• Data are transferred via a symbol configuration (is not available by default)
Impact: The exploitation of the missing critical step in authentication may result in unauthorized use of the OPC-UA interface.
Mitigation: As part of a security strategy, Lenze SE recommends the following general defense measures to reduce the risk of exploits:
• Only use the products in a protected and controlled environment to minimize network impact and to ensure that they are inaccessible from outside.
• Use external firewalls to protect the automation system network and to separate it from other networks. Remark: One Measure should be to block port 4840 via the external firewall and open this port for authenticated access only.
• Use Virtual Private Networks (VPN) tunnels when remote access is required.
• Use IDS (Intrusion Detection Systems) where possible to detect anomalies in the network.
• Activate and use user administration and password functions.
• Use encrypted communication links.
• Restrict access to both the development tools and their projects and the products of the automation system by physical means, operating system functions, etc.
• Protect the development tool by using the latest virus detection solutions.
• Use of certificate-based communication via the message security modes Sign or Sign&Encrypt and trust of the corresponding client certificates on the machine controller by the OPC-UA server. This can reduce the risk of exploiting this vulnerability.
Remediation: Install version V01.08.01.3021, which solves the identified security vulnerability.
Multiple Lenze products of the cabinet series skip the password verification upon second login. After a user has been logged on to the device once, a remote attacker can get full access without knowledge of the password.
9.8 (Critical)
Mitigation
As part of a security strategy, Lenze SE recommends the following general defense measures to reduce the risk of exploits:
• Only use the products in a protected and controlled environment to minimize network impact and to ensure that they are inaccessible from outside.
• Use external firewalls to protect the automation system network and to separate it from other networks. Remark: One Measure should be to block port 4840 via the external firewall and open this port for authenticated access only.
• Use Virtual Private Networks (VPN) tunnels when remote access is required.
• Use IDS (Intrusion Detection Systems) where possible to detect anomalies in the network.
• Activate and use user administration and password functions.
• Use encrypted communication links.
• Restrict access to both the development tools and their projects and the products of the automation system by physical means, operating system functions, etc.
• Protect the development tool by using the latest virus detection solutions.
• Use of certificate-based communication via the message security modes Sign or Sign&Encrypt and trust of the corresponding client certificates on the machine controller by the OPC-UA server. This can reduce the risk of exploiting this vulnerability.
Vendor Fix
Install version V01.08.01.3021, which solves the identified security vulnerability.
References
| URL | Category | |
|---|---|---|
Acknowledgments
CERT@VDE
certvde.com
{
"document": {
"acknowledgments": [
{
"organization": "CERT@VDE",
"summary": "coordination",
"urls": [
"https://certvde.com"
]
}
],
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en-GB",
"notes": [
{
"category": "summary",
"text": "The machine controller of the cabinet series include an OPC-UA server which uses an user management to authenticate clients via anonymous or user/password authentication. If the user/password authentication is selected, password verification is skipped upon second login. As a result, cases occur in which users can establish communication without correct authentication. This vulnerability is not located in the OPC-UA protocol or server, but in the interface to the products firmware.\n\nThis Security Advisory is only relevant for the following use cases:\n\n\u2022 the user management has been activated on the machine controller (is deactivated by default)\n\n\u2022 the OPC-UA Server is used\n\n\u2022 Data are transferred via a symbol configuration (is not available by default)",
"title": "Summary"
},
{
"category": "description",
"text": "The exploitation of the missing critical step in authentication may result in unauthorized use of the OPC-UA interface.",
"title": "Impact"
},
{
"category": "description",
"text": "As part of a security strategy, Lenze SE recommends the following general defense measures to reduce the risk of exploits:\n\n\u2022 Only use the products in a protected and controlled environment to minimize network impact and to ensure that they are inaccessible from outside.\n\n\u2022 Use external firewalls to protect the automation system network and to separate it from other networks. Remark: One Measure should be to block port 4840 via the external firewall and open this port for authenticated access only.\n\n\u2022 Use Virtual Private Networks (VPN) tunnels when remote access is required.\n\n\u2022 Use IDS (Intrusion Detection Systems) where possible to detect anomalies in the network.\n\n\u2022 Activate and use user administration and password functions.\n\n\u2022 Use encrypted communication links.\n\n\u2022 Restrict access to both the development tools and their projects and the products of the automation system by physical means, operating system functions, etc.\n\n\u2022 Protect the development tool by using the latest virus detection solutions.\n\n\u2022 Use of certificate-based communication via the message security modes Sign or Sign\u0026Encrypt and trust of the corresponding client certificates on the machine controller by the OPC-UA server. This can reduce the risk of exploiting this vulnerability.",
"title": "Mitigation"
},
{
"category": "description",
"text": "Install version V01.08.01.3021, which solves the identified security vulnerability.",
"title": "Remediation"
}
],
"publisher": {
"category": "vendor",
"contact_details": "psirt@lenze.com",
"name": "Lenze SE",
"namespace": "https://www.lenze.com"
},
"references": [
{
"category": "self",
"summary": "VDE-2022-030: Lenze: Vulnerability in the OPC-UA authentification connection in the firmware - HTML",
"url": "https://certvde.com/en/advisories/VDE-2022-030/"
},
{
"category": "self",
"summary": "VDE-2022-030: Lenze: Vulnerability in the OPC-UA authentification connection in the firmware - CSAF",
"url": "https://lenze.csaf-tp.certvde.com/.well-known/csaf/white/2022/vde-2022-030.json"
},
{
"category": "external",
"summary": "Vendor PSIRT",
"url": "https://www.lenze.com"
},
{
"category": "external",
"summary": "CERT@VDE Security Advisories for Lenze SE",
"url": "https://certvde.com/en/advisories/vendor/lenze/"
}
],
"title": "Lenze: Vulnerability in the OPC-UA authentification connection in the firmware",
"tracking": {
"aliases": [
"VDE-2022-030"
],
"current_release_date": "2022-07-11T10:00:00.000Z",
"generator": {
"date": "2025-04-23T18:36:11.196Z",
"engine": {
"name": "Secvisogram",
"version": "2.5.23"
}
},
"id": "VDE-2022-030",
"initial_release_date": "2022-07-11T10:00:00.000Z",
"revision_history": [
{
"date": "2022-07-11T10:00:00.000Z",
"number": "1",
"summary": "Initial revision."
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "cabinet c520",
"product": {
"name": "cabinet c520",
"product_id": "CSAFPID-11001"
}
},
{
"category": "product_name",
"name": "cabinet c550",
"product": {
"name": "cabinet c550",
"product_id": "CSAFPID-11002"
}
},
{
"category": "product_name",
"name": "cabinet c750",
"product": {
"name": "cabinet c750",
"product_id": "CSAFPID-11003"
}
}
],
"category": "product_family",
"name": "Hardware"
},
{
"branches": [
{
"category": "product_version_range",
"name": "V01.07.00.2757\u003cV01.08.01.3021",
"product": {
"name": "Firmware V01.07.00.2757\u003cV01.08.01.3021",
"product_id": "CSAFPID-21001"
}
},
{
"category": "product_version",
"name": "V01.08.01.3021",
"product": {
"name": "Firmware V01.08.01.3021",
"product_id": "CSAFPID-22001"
}
}
],
"category": "product_family",
"name": "Firmware"
}
],
"category": "vendor",
"name": "Lenze"
}
],
"product_groups": [
{
"group_id": "CSAFGID-0001",
"product_ids": [
"CSAFPID-31001",
"CSAFPID-31002",
"CSAFPID-31003"
],
"summary": "Affected products."
},
{
"group_id": "CSAFGID-0002",
"product_ids": [
"CSAFPID-32001",
"CSAFPID-32002",
"CSAFPID-32003"
],
"summary": "Fixed products."
}
],
"relationships": [
{
"category": "installed_on",
"full_product_name": {
"name": "Firmware V01.07.00.2757\u003cV01.08.01.3021 installed on cabinet c520",
"product_id": "CSAFPID-31001"
},
"product_reference": "CSAFPID-21001",
"relates_to_product_reference": "CSAFPID-11001"
},
{
"category": "installed_on",
"full_product_name": {
"name": "Firmware V01.07.00.2757\u003cV01.08.01.3021 installed on cabinet c550",
"product_id": "CSAFPID-31002"
},
"product_reference": "CSAFPID-21001",
"relates_to_product_reference": "CSAFPID-11002"
},
{
"category": "installed_on",
"full_product_name": {
"name": "Firmware V01.07.00.2757\u003cV01.08.01.3021 installed on cabinet c750",
"product_id": "CSAFPID-31003"
},
"product_reference": "CSAFPID-21001",
"relates_to_product_reference": "CSAFPID-11003"
},
{
"category": "installed_on",
"full_product_name": {
"name": "Firmware V01.08.01.3021 installed on cabinet c520",
"product_id": "CSAFPID-32001"
},
"product_reference": "CSAFPID-22001",
"relates_to_product_reference": "CSAFPID-11001"
},
{
"category": "installed_on",
"full_product_name": {
"name": "Firmware V01.08.01.3021 installed on cabinet c550",
"product_id": "CSAFPID-32002"
},
"product_reference": "CSAFPID-22001",
"relates_to_product_reference": "CSAFPID-11002"
},
{
"category": "installed_on",
"full_product_name": {
"name": "Firmware V01.08.01.3021 installed on cabinet c750",
"product_id": "CSAFPID-32003"
},
"product_reference": "CSAFPID-22001",
"relates_to_product_reference": "CSAFPID-11003"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2022-2302",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"notes": [
{
"category": "description",
"text": "Multiple Lenze products of the cabinet series skip the password verification upon second login. After a user has been logged on to the device once, a remote attacker can get full access without knowledge of the password.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-32001",
"CSAFPID-32002",
"CSAFPID-32003"
],
"known_affected": [
"CSAFPID-31001",
"CSAFPID-31002",
"CSAFPID-31003"
]
},
"remediations": [
{
"category": "mitigation",
"details": "As part of a security strategy, Lenze SE recommends the following general defense measures to reduce the risk of exploits:\n\n\u2022 Only use the products in a protected and controlled environment to minimize network impact and to ensure that they are inaccessible from outside.\n\n\u2022 Use external firewalls to protect the automation system network and to separate it from other networks. Remark: One Measure should be to block port 4840 via the external firewall and open this port for authenticated access only.\n\n\u2022 Use Virtual Private Networks (VPN) tunnels when remote access is required.\n\n\u2022 Use IDS (Intrusion Detection Systems) where possible to detect anomalies in the network.\n\n\u2022 Activate and use user administration and password functions.\n\n\u2022 Use encrypted communication links.\n\n\u2022 Restrict access to both the development tools and their projects and the products of the automation system by physical means, operating system functions, etc.\n\n\u2022 Protect the development tool by using the latest virus detection solutions.\n\n\u2022 Use of certificate-based communication via the message security modes Sign or Sign\u0026Encrypt and trust of the corresponding client certificates on the machine controller by the OPC-UA server. This can reduce the risk of exploiting this vulnerability.",
"group_ids": [
"CSAFGID-0001"
]
},
{
"category": "vendor_fix",
"details": "Install version V01.08.01.3021, which solves the identified security vulnerability.",
"group_ids": [
"CSAFGID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"environmentalScore": 9.8,
"environmentalSeverity": "CRITICAL",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 9.8,
"temporalSeverity": "CRITICAL",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-31001",
"CSAFPID-31002",
"CSAFPID-31003"
]
}
],
"title": "CVE-2022-2302"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…