Full Report
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) released three advisories on Tuesday detailing current security issues, vulnerabilities,... The post CISA discloses security flaws in aircraft collision avoidance systems, Siemens industrial equipment appeared first on Industrial Cyber.
Analysis Summary
# Vulnerability: Multiple ICS Vulnerabilities Reported by CISA (TCAS II, Siemens S7-1200, ZF RSSPlus)
## CVE Details
### Vulnerability 1 (TCAS II - Untrusted Input/Control)
- CVE ID: CVE-2024-9310
- CVSS Score: 6.1 (v3.1) / 6.0 (v4) (Medium)
- CWE: Reliance on untrusted inputs in a security decision, External control of system or configuration setting (Inferred details)
### Vulnerability 2 (TCAS II - Ground Station Impersonation)
- CVE ID: CVE-2024-11166
- CVSS Score: 8.2 (v3.1) / 7.1 (v4) (High)
- CWE: Not specified
### Vulnerability 3 (Siemens S7-1200 CPU CSRF)
- CVE ID: CVE-2024-47100
- CVSS Score: 7.1 (v3) / 7.2 (v4) (High)
- CWE: Cross-Site Request Forgery (CSRF)
### Vulnerability 4 (ZF RSSPlus Authentication Bypass)
- CVE ID: CVE-2024-12054
- CVSS Score: 5.4 (v3.1) / 5.9 (v4) (Medium)
- CWE: Authentication Bypass by Primary Weakness
## Affected Systems
### TCAS II (CVE-2024-9310 & CVE-2024-11166)
- Products: Traffic Alert and Collision Avoidance System (TCAS) II
- Versions: Versions 7.1 and prior (for CVE-2024-9310). For CVE-2024-11166, systems using transponders compliant with MOPS earlier than RTCA DO-181F.
- Configurations: Airborne systems utilizing TCAS II.
### Siemens SIMATIC S7-1200 CPUs (CVE-2024-47100)
- Products: Siemens SIMATIC S7-1200 CPUs, SIPLUS S7-1200 CPU.
- Versions: Prior to V4.7 (Requires upgrade to V4.7 or later).
- Configurations: Devices with accessible web interfaces.
### ZF RSSPlus (CVE-2024-12054)
- Products: ZF RSSPlus equipment.
- Versions: Not specified, but related to the utilization of J2497 technology.
- Configurations: Equipment supporting J2497 telematics device communication or proximal RF interaction.
## Vulnerability Description
**CVE-2024-9310 & CVE-2024-11166 (TCAS II):** These vulnerabilities stem from reliance on untrusted inputs and external control over system configuration. Specifically for CVE-2024-11166, an attacker can impersonate a ground station, issue a Comm-A Identity Request, which sets the Sensitivity Level Control (SLC) to the lowest setting and disables the Resolution Advisory (RA), causing a denial-of-service condition. Malicious RF signals with spoofed location data can also be transmitted to trigger undesired Resolution Advisories.
**CVE-2024-47100 (Siemens CSRF):** The web interface of the affected Siemens CPUs is vulnerable to CSRF. An unauthenticated attacker can trick an authenticated user with sufficient permissions into clicking a malicious link, allowing the attacker to change the CPU mode.
**CVE-2024-12054 (ZF RSSPlus):** This is an authentication bypass targeting deterministic RSSPlus SecurityAccess service seeds. It allows an unauthenticated attacker, remotely via proximal RF equipment or through pivoting from J2497 telematics devices, to call diagnostic functions intended for workshop use.
## Exploitation
- Status: **PoC available** (Lab environment exploitation confirmed for TCAS II). No known public exploitation reported to CISA for any of these CVEs.
- Complexity: **High** (For TCAS II flaws, requiring very specific conditions). **Low** (For Siemens CSRF, tricking a user). **Proximal/Adjacent** (For ZF RSSPlus).
- Attack Vector: TCAS II is not remotely exploitable. CSRF requires user interaction (adjacent/local implied). ZF RSSPlus involves Adjacent (RF equipment) or Local (via J2497 pivot).
## Impact
| CVE | Confidentiality | Integrity | Availability |
| :--- | :--- | :--- | :--- |
| **CVE-2024-9310** | Unknown | Unknown | Denial-of-Service (manipulate safety systems) |
| **CVE-2024-11166** | Not Specified | Not Specified | Denial-of-Service (Disable RA) |
| **CVE-2024-47100** | Negligible | High (CPU mode change) | Negligible |
| **CVE-2024-12054** | Negligible | High (Diagnostic function execution) | High (Degrade performance or erase software) |
## Remediation
### Patches
- **CVE-2024-9310/11166 (TCAS II):** Upgrade to **ACAS X**, or upgrade the associated transponder to comply with **RTCA DO-181F**.
- **CVE-2024-47100 (Siemens):** Update SIMATIC S7-1200 CPU to **V4.7 or later**. Update SIPLUS S7-1200 CPU to **V4.7 or later**.
- **CVE-2024-12054 (ZF RSSPlus):** Implement the latest security feature **authenticate (0x29)**. Ensure random numbers are generated from a Cryptographically Secure Hardware True Random Number Generator (CSTRNG). Adopt modern standards/protocols for truck trailer communication.
### Workarounds
- **CVE-2024-9310/11166 (TCAS II):** No mitigation currently available for CVE-2024-9310.
- **CVE-2024-47100 (Siemens CSRF):** Avoid clicking links from untrusted sources.
- **CVE-2024-12054 (ZF RSSPlus Mitigations focused on J2497/diagnostics):**
1. Disable all non-essential J2497 features, except backwards-compatibility for LAMP ON detection only.
2. For new trailer equipment, migrate diagnostics to newer trailer bus technology.
3. For new tractor equipment, remove support for receiving any J2497 messages other than LAMP messages.
4. Implement a LAMP ON firewall for each ECU.
5. Use a LAMP detect circuit LAMP ON sender with each trailer.
6. Dynamically change tractor addresses upon detecting a transmitter on its current address.
7. Install RF chokes on each trailer between chassis ground and wiring ground.
8. Load with LAMP keyhole signal on each tractor.
9. Flood with jamming signal on each tractor.
## Detection
- **CVE-2024-9310/11166 (TCAS II):** Monitor for unexpected Resolution Advisories (RAs) or unusual changes in Sensitivity Level Control (SLC) settings that are not pilot-initiated.
- **CVE-2024-47100 (Siemens CSRF):** Monitor web server logs for requests that appear to change CPU mode without standard authentication workflows.
- **CVE-2024-12054 (ZF RSSPlus):** Monitor for unauthenticated remote calls to diagnostic functions (e.g., workshop service calls) originating from proximal RF sources or J2497 pivots.
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA.
## References
- https://industrialcyber.co/control-device-security/cisa-reports-security-vulnerabilities-in-ics-equipment-from-schneider-electric-delta-electronics-rockwell-automation/
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-021-01
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-021-02
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-021-03
- https://support.industry.siemens.com/cs/ww/en/view/109976907/
- https://nbaa.org/aircraft-operations/communications-navigation-surveillance-cns/tcas/
- https://industrialcyber.co/analysis/takepoint-research-whitepaper-focuses-on-cybersecurity-in-manufacturing-critical-infrastructure-sectors/