Emerson Ovation OCR400 Controller

Risk Summary

Successful exploitation of these vulnerabilities may allow privilege escalation or remote code execution, or it may halt the controller.

CVEs (2)

Remediations

• Emerson is issuing a notice to its customer base with mitigation recommendations, encouraging users with this older software to upgrade to a more current version supported by Emerson and the third-party vendor.
• For users with installations of the affected versions, Emerson recommends following the instructions outlined in Step 1 and Step 2 (below) to determine whether communication services (including FTP) have been enabled. If communication services have been enabled, Emerson recommends users return FTP services to their default (disabled) state as soon as is practical. If users are unable to make controller changes or disable communication services per the instructions below, they are strongly encouraged to restrict FTP communications to the required database and controller drops only. Review Ovation Software and Hardware
• Step 1 - Check the Ovation Controller Type
• In Ovation Developer Studio, right-click on each controller object, select “Open” and review the “Controller Type” listed. Alternately, run a System Registration report and verify the “Model” for each controller.
• OCR400: The controller is potentially affected continue with Step 2 (below)
• OCR161: The controller is not affected by the vulnerabilities detailed in this advisory, and can be disregarded
• Step 2 - Check the Ovation Software Version
• Ovation v3.0.4 and older
• FTP services cannot be disabled using the Communications Services configuration detailed below. Emerson recommends users of retired systems, including Ovation v3.3.1 and older, consider upgrading to a more current version in which these issues do not exist.
• However, separate mitigation involving network configuration may still be possible. Please refer to the “Review Ovation Highway Switch Configuration” section (below).
• Ovation v3.1.0 - v3.3.1
• Follow the “Determine Current State of Communications Services” (below).
• Ovation v3.5.0 and Newer
• FTP communications services cannot be enabled. This advisory does not apply to those versions.
• Determine Current State of Communication Services
• 1. Ovation Developer Studio
• 2. Controller Diagnostics application
• Method 1 - Use Ovation Developer Studio to determine the state and modify as needed
• The steps necessary to review and/or modify communications services settings can be found in Section 5.10.1 of the Developer Studio User Guide for Ovation 3.3.1 (PWS_005981), which is available on the Ovation Users' Group website: www.ovationusers.com (this website requires registration).
• Method 2 - Use Controller Diagnostics to determine the state and modify as needed
• 1. Open the Controller Diagnostic application on an Ovation HMI.
• 2. Select a drop pair by double-clicking on it in the lower-left tree.
• 3. In the upper-left menu, verify the “Comm Services” section is set to “Disabled” for both the primary and secondary controllers.
• 4. If “Enabled,” left-click on the object to activate the drop-down menu and select “Disabled.” Review Ovation Highway Switch Configurations
• Systems using Cisco 2960 and/or 3750 switches on the Ovation Highway may be able to limit FTP communications (as well as telnet, rlogin, and SSH) using access control lists (ACLs). Please refer to the whitepaper “Enabling TELNET, SSH, RLOGIN & FTP Blocking on Ovation Switches,” which is available at www.ovationusers.com (Support and Security | Security | Network Whitepapers).
• Ovation Contact Information
• Ovation users with questions or concerns regarding the impact of these vulnerabilities on Ovation should contact the Ovation-CERT via email at [email protected] or by phone at 1-800-445-9723, Option 3.

Affected Vendors

Affected Products (1)

Affected Sectors

Electrical (Power Generation), Water and Wastewater