Following Unprecedented FBI and Department of Homeland Security Warning, Tenable Research Discovers Vulnerability in Critical Infrastructure

COLUMBIA, Md., May 2, 2018 /PRNewswire/ -- Tenable®, Inc., the Cyber Exposure company, recently discovered a critical remote code execution vulnerability in two Schneider Electric applications used in manufacturing, oil and gas, water, automation and wind and solar power facilities. If exploited, the vulnerability could give cybercriminals complete control of the underlying system. Attackers would also be able to use the compromised system to move laterally through the network, exposing additional systems to attack, including human-machine interface (HMI) clients. In a worst case scenario, attackers could use the vulnerability to disrupt or even cripple plant operations.

This discovery comes just weeks after the Department of Homeland Security and the FBI issued a joint warning about Russian state-sponsored attacks against U.S. critical infrastructure. As underscored by the joint warning, OT systems have become high-value targets for cybercriminals around the world, which presents major challenges to human safety as well as ongoing productivity, uptime and efficiency. At the same time, the deployment of cybersecurity measures lags behind the digitization of our critical infrastructure, resulting in an acute inability to accurately understand and represent cybersecurity risk at any given time -- creating a massive Cyber Exposure gap.

The vulnerability discovered by Tenable Research impacts InduSoft Web Studio, an automation tool used to develop HMIs, supervisory control and data acquisition (SCADA) systems and embedded instrumentation solutions that connect OT with the Internet or corporate intranets, and InTouch Machine Edition, a scalable HMI client. This software is commonly deployed across several heavy industries, including manufacturing, oil and gas and automotive. With the growing adoption of distributed and remote monitoring in industrial environments, OT and IT are converging. As OT becomes increasingly connected and boundaryless, these safety-critical systems are increasingly vulnerable to cyberattacks.

"Digital transformation has made its way to critical infrastructure, connecting once-isolated systems to the outside world," said Dave Cole, chief product officer, Tenable. "This Schneider Electric vulnerability is particularly concerning because of the potential access it grants cybercriminals looking to do serious damage to mission-critical systems that quite literally power our communities. Tenable Research is focused on assessing, analyzing and reducing the industry's overall Cyber Exposure across the modern computing environment -- be it cloud, IT, IoT or OT. Solving this growing problem requires us to come together as an industry and we commend Schneider Electric at the speed they released a patch to remediate this critical issue."

A remote attacker without credentials can leverage this vulnerability to execute arbitrary code on vulnerable systems, potentially leading to full compromise of the InduSoft Web Studio or InTouch Machine Edition server machine. A threat actor can use the compromised machine to laterally move within the victim's network and execute further attacks.

Tenable Research worked with the vendor to responsibly disclose the vulnerability and Schneider Electric has released patches for both affected systems. Given the widespread prevalence and market share of the affected software in the OT space, urgent attention and response from affected users are required.

For more information on the vulnerability, read the Tenable Research Advisory blog post here.

Join industry experts on May 2, 2018 at 2 p.m. ET for a panel discussion on 'Exploring the Challenge of Developing an Asset Inventory for Converged IT/OT Environments.' Register for the webinar here. 

About Tenable
Tenable®, Inc. is the Cyber Exposure company. Over 24,000 organizations around the globe rely on Tenable to understand and reduce cyber risk. As the creator of Nessus®, Tenable extended its expertise in vulnerabilities to deliver Tenable.io®, the world's first platform to see and secure any digital asset on any computing platform. Tenable customers include more than 50 percent of the Fortune 500, more than 20 percent of the Global 2000 and large government agencies. Learn more at tenable.com.

Contact Information:
Cayla Baker
Tenable
[email protected]
443-545-2102, x 1544

SOURCE Tenable, Inc.

Related Links

http://tenable.com