Earlier this week, cybersecurity researchers at JSOF disclosed a set of 19 zero-day vulnerabilities, collectively known as Ripple20, present within a low-level TCP/IP software library used by hundreds of millions of devices, including numerous operational technology (OT) devices. The published vulnerabilities could allow an adversary to conduct denial-of-service attacks, and may possibly allow for remote code execution on affected devices.
Claroty assisted the research team at JSOF by providing consulting services and offering access to our extensive industrial control systems (ICS) lab environment, thus supporting efforts to map out which devices are susceptible to the Ripple20 vulnerabilities. To assist in the mitigation of these vulnerabilities, Claroty is the process of issuing a threat bundle, which will include signatures and CVE correlations based on all available vendor advisories.
The disclosed vulnerabilities affect the network stack of devices using the Treck embedded IP stack, much like the Urgent/11 vulnerabilities disclosed last year. And since this kind of attack is affecting the basic communication libraries on vulnerable devices, authentication is usually not required.
The full scope of products affected by the Ripple20 vulnerabilities is not yet clear, and public disclosures from the different vendors are expected in the coming weeks. According to JSOF, affected vendors range from small boutique shops to major corporations including HP, Schneider Electric, Intel, Rockwell Automation, Caterpillar, and Baxter, among others. More broadly, JSOF identifies the industrial, medical, retail, transportation, oil and gas, aviation, and government sectors as particularly vulnerable to the Ripple20 vulnerabilities, in addition to power grids, home appliances, networking devices, and other IoT-connected devices.
The following advisories have been issued for Ripple20:
Vendor advisories: Intel, HP, Schneider Electric, Caterpillar, B.Braun, Green Hills, Rockwell Automation, Cisco
The Claroty team will continue to monitor the situation, and when necessary, provide updates as new information becomes available. For more information about risk evaluation and mitigations, click here.
CWE-191 INTEGER UNDERFLOW (WRAP OR WRAPAROUND):
The affected product is vulnerable to an integer underflow. An unauthenticated attacker could send a malformed HTTP Requesty, which could allow the attacker to crash the program.
Planet Technology recommends users upgrade to version 1.305b241111 or later.
CVSS v3: 5.3
CWE-78 IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN AN OS COMMAND ('OS COMMAND INJECTION'):
The affected product is vulnerable to a command injection. An unauthenticated attacker could send commands through a malicious HTTP request which could result in remote code execution.
Planet Technology recommends users upgrade to version 1.305b241111 or later.
CVSS v3: 9.8
CWE-121 STACK-BASED BUFFER OVERFLOW:
The affected product is vulnerable to a stack-based buffer overflow. An unauthenticated attacker could send a malicious HTTP request that the webserver fails to properly check input size before copying data to the stack, potentially allowing remote code execution.
Planet Technology recommends users upgrade to version 1.305b241111 or later.
CVSS v3: 9.8
CWE-359 Exposure of Private Personal Information to an Unauthorized Actor:
Ruijie Reyee OS versions prior to 2.260.0.1329 contains a a feature that could enable sub accounts
or attackers attackers to view and exfiltrate sensitive information from all cloud accounts registered to Ruijie's services.
CVSS v3: 6.5
CWE-1391 Use of Weak Credentials:
Ruijie Reyee OS versions prior to 2.260.0.1329 uses weak credential mechanism that could allow
an attacker to easily calculate MQTT credentials.
Ruijie reports that the issues have been fixed on the cloud and no action is needed by end users.
CVSS v3: 7.5
