Full Report
Dangerous vulnerabilities have been identified in the Schneider Electric Floating License Manager platform.
Analysis Summary
# Vulnerability: Multiple Flaws in Schneider Electric Floating License Manager
## CVE Details
- **CVE ID:** CVE-2018-7790, CVE-2018-7791, CVE-2018-7792
- **CVSS Score:** 7.5 (High) - *Based on the maximum score assigned to the set.*
- **CWE:** CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-20 (Improper Input Validation)
## Affected Systems
- **Products:** Schneider Electric Floating License Manager (part of the EcoStruxure software suite).
- **Versions:** All versions prior to v2.2.0.0.
- **Configurations:** Systems utilizing the Flexnet Publisher components integrated into the Schneider Electric licensing platform.
## Vulnerability Description
The Floating License Manager contains multiple vulnerabilities primarily stemming from the integration of third-party components (Flexera Flexnet Publisher).
1. **Memory Corruption:** A flaw in the way the application processes specially crafted heartbeats or license files can lead to a buffer overflow.
2. **Input Validation:** Inadequate validation of user-supplied data allows attackers to send malformed packets to the license server, potentially triggering a crash or remote code execution.
3. **Denial of Service:** Vulnerabilities in the request handling mechanism can be leveraged to exhaust resources or crash the licensing service, preventing legitimate users from checking out software licenses.
## Exploitation
- **Status:** PoC available (Publicly documented vulnerabilities in the underlying Flexera components).
- **Complexity:** Low to Medium.
- **Attack Vector:** Network (The vulnerabilities can be exploited remotely by sending crafted packets to the listening port of the License Manager, typically TCP port 27000-27009).
## Impact
- **Confidentiality:** Low (Potential for memory leakage in specific scenarios).
- **Integrity:** High (Potential for Remote Code Execution).
- **Availability:** High (Service crash leading to total loss of licensing functionality for the industrial environment).
## Remediation
### Patches
- **Update to Floating License Manager v2.2.0.0 or later.**
- Schneider Electric has released updated installers that include the patched Flexera Flexnet Publisher components (v11.14.1.3 or higher).
### Workarounds
- **Network Segmentation:** Place the License Manager server behind a firewall and restrict access to the license server ports (default TCP 27000-27009 and the vendor daemon port) to only authorized client workstations.
- **Access Control:** Utilize VPNs for remote license borrowing and ensure the server is not exposed to the public internet.
## Detection
- **Indicators of Compromise:** Unusual service crashes of `lmgrd.exe` or the Schneider Electric vendor daemon (`SE_Internal.exe`).
- **Detection Methods:** Monitor network traffic for malformed Flexnet packets or repeated connection attempts from unauthorized IP addresses. Use Intrusion Detection Systems (IDS) with signatures for Flexnet Publisher buffer overflows.
## References
- **Schneider Electric Advisory:** hxxps[://]www[.]se[.]com/ww/en/download/document/SEVD-2018-135-01/
- **Kaspersky ICS CERT:** hxxps[://]ics-cert[.]kaspersky[.]com/advisories/2018/05/29/multiple-vulnerabilities-in-schneider-electric-floating-license-manager/
- **NVD CVE-2018-7790:** hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2018-7790