Full Report
Schneider Electric has released patches for a vulnerability which affects InduSoft Web Studio and HMI InTouch Machine Edition products
Analysis Summary
# Vulnerability: Stack-based Buffer Overflow in Schneider Electric HMI Software
## CVE Details
- **CVE ID:** CVE-2017-14024
- **CVSS Score:** 9.8 (Critical)
- **CWE:** CWE-121 (Stack-based Buffer Overflow)
## Affected Systems
- **Products:**
- InduSoft Web Studio
- InTouch Machine Edition (formerly HMI InTouch Machine Edition)
- **Versions:**
- InduSoft Web Studio: v8.0 SP2 and prior versions
- InTouch Machine Edition: v8.0 SP2 and prior versions
- **Configurations:** Systems running the runtime component with networking enabled, specifically those processing malformed packets via the TCP protocol.
## Vulnerability Description
The vulnerability is a stack-based buffer overflow flaw located within the runtime components of the affected software. It is triggered when the application fails to properly validate the length of data before copying it to a fixed-length stack buffer. An attacker can exploit this by sending a specially crafted packet to the data server (typically on TCP Port 1234). If successful, this can lead to the overwrite of memory, allowing for arbitrary code execution under the privileges of the runtime process.
## Exploitation
- **Status:** Publicly disclosed; PoC (Proof of Concept) code has been demonstrated/available in security research circles.
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** Total (Allows unauthorized access to data)
- **Integrity:** Total (Allows unauthorized modification of system files/logic)
- **Availability:** Total (Can lead to service crashes or full system takeover)
## Remediation
### Patches
Schneider Electric has released the following updates to address the flaw:
- **InduSoft Web Studio:** Upgrade to v8.0 SP2 Patch 1 or later.
- **InTouch Machine Edition:** Upgrade to v8.0 SP2 Patch 1 or later.
### Workarounds
- **Firewall Filtering:** Restrict access to TCP Port 1234 (default port for the InduSoft/InTouch TCP server) to only authorized IP addresses or internal engineering workstations.
- **Network Segmentation:** Place HMI and SCADA systems behind firewalls and isolate them from the business network or the public internet.
- **Disable Unused Services:** If remote management or data synchronization via these protocols is not required, disable the associated services.
## Detection
- **Indicators of Compromise:** Monitor for unusual traffic targeting TCP Port 1234 originating from unauthorized or external IP addresses.
- **Detection methods:** Use Intrusion Detection Systems (IDS) with signatures designed to catch large/malformed packet headers targeting the InduSoft runtime service.
## References
- **Schneider Electric Advisory:** hxxps[://]www[.]se[.]com/ww/en/download/document/SEVD-2017-290-01/
- **ICS-CERT Advisory:** hxxps[://]www[.]cisa[.]gov/news-events/ics-advisories/icsa-17-292-01
- **Kaspersky ICS CERT:** hxxps[://]ics-cert[.]kaspersky[.]com/publications/2017/11/16/schneider-electric-closes-critical-vulnerability-in-hmi-products/