Haas Controller

Risk Summary

Successful exploitation of these vulnerabilities could allow an unauthorized attacker to cause denial-of-service of the production line, damage the tools used in the production line, introduce defects in pieces of the production line, and perform remote code execution.

CVEs (3)

Remediations

• Haas Automation recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Specifically, users should:
• Locate control system devices and/or systems behind firewalls and isolate them from business networks.
• Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.
• Ensure physical access controls are in place; only authorized end-users should have access to control systems.
• Add authentication to the “Ethernet Q Commands” service and use a strong enforced password.
• Add encryption where possible to prevent data sniffing and capturing of the authentication password.
• Limit the number of macros that can be written.

Affected Vendors

Affected Products (1)

Affected Sectors

Critical Manufacturing