While performing a security assessment for one of its clients in the critical infrastructure sector, the Kaspersky Lab Security Services team discovered an important vulnerability. The CVE-2016-4785 vulnerability could allow an attacker to remotely obtain a limited amount of device memory content from relay protection equipment. The vulnerability was reported to Siemens, the equipment vendor, and has already been patched.
Siemens has acknowledged the vulnerability and has released an advisory with useful instructions on mitigation and updates. Kaspersky Lab urges any security specialists working for organisations that use this kind of equipment, to pay close attention to the advisory and follow its recommendations.
“Finding vulnerabilities like this is not our primary job, but experience shows us that when we undertake security assessment procedures, it’s almost inevitable that we will find something. The end user of vulnerable products usually has nothing to do with the vulnerability itself, and remains at risk of attack even if other parts of the IT infrastructure are organised and tuned rather well. For these reasons it’s our responsibility to report on every security weakness we find during our day to day work. This is a key part of our contribution to the security community. We would also like to thank ICS CERT for coordinating the disclosure of this vulnerability, and Siemens for its swift reaction to the news,” said Sergey Gordeychik Deputy CTO, Services at Kaspersky Lab.
During the last 12 months, Kaspersky Lab experts have responsibly disclosed more than 20 vulnerabilities in different hardware and software products: from consumer devices to industrial control systems and vehicle and railway routers.
