Overview

A critical vulnerability, identified as CVE-2022-24999, has been discovered in ABB's RMC-100 and RMC-100 LITE controllers, widely utilized in industrial automation systems. This flaw, rated with a CVSS v4 score of 8.7, exposes manufacturing operations to potential denial-of-service (DoS) attacks, underscoring the pressing need for immediate remediation measures.

Background on ABB RMC-100 Controllers

ABB's RMC-100 series controllers are integral components in industrial control systems (ICS), facilitating precise control and monitoring of manufacturing processes. These devices are prevalent across various sectors, including oil and gas, manufacturing, and commercial facilities, due to their reliability and advanced features.

Technical Details of CVE-2022-24999

The vulnerability resides in the web user interface (UI) of the RMC-100 controllers, specifically within the RESTful API. It stems from a prototype pollution issue, a type of vulnerability that allows attackers to manipulate the prototype of JavaScript objects, leading to unintended behavior. Exploitation of this flaw can result in the crash of the web UI's node process, causing a DoS condition that necessitates a manual restart of the interface.

Affected Versions:
  • RMC-100: Firmware versions 2105457-036 to 2105457-044
  • RMC-100 LITE: Firmware versions 2106229-010 to 2106229-016
Attack Vector:
  • Network-based, requiring access to the REST interface, which is disabled by default but may be enabled for specific configurations.

Implications and Impact

While the primary risk associated with CVE-2022-24999 is a DoS condition, the consequences in industrial environments can be severe. Disruptions in control systems can lead to halted production lines, safety hazards, and significant financial losses. Moreover, the vulnerability highlights the broader issue of securing industrial IoT devices against emerging cyber threats.

Mitigation Strategies

ABB has released firmware updates to address this vulnerability:

  • RMC-100: Update to Customer Package 2105452-048
  • RMC-100 LITE: Update to Customer Package 2106260-017
Additional Recommendations:
  • Disable Unnecessary Interfaces: Keep the REST interface disabled unless required for specific configurations.
  • Network Segmentation: Isolate control networks from external and corporate networks to limit exposure.
  • Access Controls: Implement strict access controls and monitor systems for unauthorized activities.

Conclusion

The discovery of CVE-2022-24999 in ABB's RMC-100 controllers serves as a critical reminder of the importance of proactive cybersecurity measures in industrial settings. Organizations must prioritize the application of security patches and adhere to best practices to safeguard their operations against potential cyber threats.