Multiple sources have confirmed the discovery of a total of 56 vulnerabilities in OT products from 10 vendors, including popular companies Honeywell, Siemens, and Emerson. According to security researchers, most of the vulnerabilities are due to a lack of basic security mechanisms such as authentication and encryption. In addition, researchers believe that asset owners continue to use some of the products even though more secure options are available. The older products receive less security maintenance, and therefore may be more vulnerable and attractive targets to threat actors.
The vulnerabilities were identified by data gathered via open source intelligence by security researchers at Forescout’s Vedere Labs. The vulnerabilities reportedly exist in popular products and protocols being used in a range of industries, including critical infrastructure domains such as oil, gas, chemical, nuclear, and power generation. The vulnerabilities have been collectively named OT Icefall. The flaws stem from several critical downfalls, including nonexistent or faulty authentication mechanisms, insecure firmware updates, and native functions that could enable remote code execution. Threat actors looking to leverage the security blunders could achieve denial-of-service attacks, file manipulation, remote code execution, authentication bypass, and credential theft.
Read More: 56 Vulnerabilities Discovered in OT Products From 10 Different Vendors