ICS Impact from Microsoft RDP Vulnerability
Summary: Microsoft released a security advisory on May 14 for CVE-2019-0708, a Remote Desktop Services vulnerability it says could enable wormable malware similar to WannaCry, which previously hit ICS entities including automotive manufacturers, rail service providers, and some U.S. utilities. The flaw affects Windows 7, Windows Server 2008 R2, Windows Server 2008, Windows 2003 and Windows XP, and because the bug is triggered by an unauthenticated request passed into the termdd.sys driver, the memory corruption occurs in kernel memory and can grant SYSTEM privileges regardless of the Windows version in use.
Key Takeaway: Exploitation has not been observed in the wild, but Microsoft has a working proof of concept, and the systems at risk - engineering workstations, HMIs, data historians, and OPC servers - are the ones ICS operators are most reluctant to take offline for patching.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Mentions
- CVE-2019-0708
- Related
- CVE-2019-0708: Microsoft Remote Desktop Services Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021