XML schema is injected into the accepted response packet. VULNERABILITY CHARACTERIZATION VULNERABILITY OVERVIEW ICS-CERT estimates that these DTMs are used in products worldwide.

ICS-CERT has concluded these devices are deployed across several sectors including Chemical, Commercial Facilities, Critical Manufacturing, Energy, Food and Agriculture, Water and Wastewater Systems, and others. The HART Comm DTM is part of the FDT/DTM architecture used to provide communication protocol information to the Frame Application. The Endress+Hauser Fieldcare manages the FDT/DTM Frame Application.

CodeWrights GmbH supplies components that are used in DTMs of other vendors. BACKGROUNDĮndress+Hauser is an international company based in Germany and Switzerland, with over 200 offices and production centers located worldwide.ĬodeWrights GmbH is a German-based company that provides device integration and management solutions. NCCIC/ICS-CERT recommends that organizations evaluate the impact of this vulnerability based on their operational environment, architecture, and product implementation. Impact to individual organizations depends on many factors that are unique to each organization.

This could allow exposure of internal resources that are not otherwise visible. In an SSRF, the network connection will originate from the application server internal IP, and an attacker will be able to use this connection to bypass network controls. This attack may cause the disclosure of confidential data, denial of service, port scanning, and other possible system impacts from the perspective of the machine where the parser is located. This leads to potential Server Side Request Forgery (SSRF) attacks or XML External Entity attacks. The HART Comm DTM reads the XML schema and attempts to retrieve XML schema or the document from the location stored in the longtag. The string is capable of storing an XML schema. When a Device DTM component receives a HART packet response to Command 20 (longtag), it extracts the longtag from the packet. Individual components are not listed within this advisory because of the extreme number of potentially impacted devices. AFFECTED PRODUCTSĪll HART DTM components relying on Fieldcare and a CodeWrights HART Comm DTM are impacted. This vulnerability could be exploited from an adjacent network receiving HART DTM packets. Alexander Bolshev has tested the updated versions to validate that it resolves the vulnerability. The vulnerability is in handling of the HART longtag response field in Endress+Hauser’s Fieldcare and CodeWrights HART Comm DTM.Įndress+Hauser Process Solutions AG and CodeWrights have produced new versions of the software that in combination mitigates the vulnerability. Alexander Bolshev of Digital Security has identified a vulnerability within Endress+Hauser HART DTM software libraries.

Codewrights hart comm dtm