Armis Discloses Critical Attack Vector that Allows Remote Take-Over of Schneider Electric Industrial Controllers

New ModiPwn vulnerability puts Schneider Electric PLCs in global organizations at risk to attacker takeover

Palo Alto, New York, London: July 13, 2021

Researchers at Armis, the unified asset visibility and security platform provider, have today announced the discovery of an authentication bypass vulnerability in Schneider Electric’s Modicon programmable logic controllers (PLCs) that can lead to remote-code-execution (RCE). The vulnerability, dubbed ModiPwn, allows for a complete takeover of impacted devices by leveraging the UMAS protocol, and impacts Modicon M340, M580 and other models from the Modicon series. Millions of these PLCs are now deemed to be at risk in what is considered to be a wide scale vulnerability. Such controllers are used widely in manufacturing, building services, automation applications, energy utilities, HVAC systems to name but a few.

How would an attacker use ModiPwn?
An attack that leverages ModiPwn would begin with network access to a Modicon PLC. Through this access, the attacker can leverage undocumented commands in the UMAS protocol and leak a certain hash from the device’s memory. Using this hash, the attacker can take over the secure connection between the controller and its managing workstation to reconfigure the controller with a password-less configuration. This will allow the attacker to abuse additional undocumented commands that lead to remote-code-execution – a full takeover of the device.

This takeover can then be used to install malware on the controller that alters its operation and hide the existence of these alterations from the workstation that manages this controller. The CVE for this vulnerability is CVE-2021-22779.

Sophisticated attacks such as this have been seen in the wild before; the Triton malware, for example, was spotted targeting safety controllers by Schneider Electric used in petrochemical plants in Saudi Arabia. Attacks that alter operations of industrial controllers are a threat to both business continuity and safety, and attacks that hide from monitoring solutions can be extremely difficult to detect.

“Armis and Schneider Electric have worked together to ensure the proper security mitigations are being provided. We urge all affected organizations to take action now,” said Ben Seri, Armis. “The trouble with these legacy devices found in OT environments is that historically, they have evolved over unencrypted protocols. It will take time to address these weak underlying protocols. In the meantime, organisations operating in these environments should ensure that they have visibility over these devices to see where their points of exposure lie. This is crucial to preventing attackers from being able to control their systems – or even hold them to ransom.”

For more information, Armis has set up the following resources to help organizations navigate the ModiPwn vulnerability: https://www.armis.com/research/modipwn/

About Armis
Armis is the leading unified asset visibility and security platform designed to address the new threat landscape that connected devices create. Fortune 1000 companies trust our real-time and continuous protection to see with full context all managed, unmanaged, and IoT devices, including medical devices (IoMT), operational technology (OT) and industrial control systems (ICS). Armis provides passive and unparalleled cybersecurity asset management, risk management, and automated enforcement. Armis is a privately held company and headquartered in Palo Alto, California.

Media Contact
info@armis.com