Experts from Trellix Threat Labs have shared research on multiple vulnerabilities in an industrial control system (ICS) used to grant physical access to protected facilities, and integrated into building automation systems. This research team has focused on threats against ICS and operational technology (OT), which have become part of the critical infrastructure in multiple organizations.
This work focused on Carrier LenelS2 access control panels, manufactured by HID Mercury and employed in medical, educational, and homeland security facilities. The research led to the detection of eight zero-day vulnerabilities whose exploitation would allow the total compromise of the system through the manipulation of smart locks.
Access point
Experts started by focusing on the lowest level of hardware. By using ports built into this system, the experts managed to manipulate the device components to force some interactions, including root access to the operating system and extraction of the firmware for further analysis.
During this access, the researchers employed several stages of attack:
- Physical access: The use of hacking techniques allowed to abuse of the debug ports on the target system, in addition to facilitating access to the software level
- Network access: Once they managed to access the firmware and binary files, the experts were able to focus on access from the network to the affected system. Using reverse engineering, six remotely exploitable security flaws were detected
- Exploitation: By chaining two of the detected faults it was possible to exploit the control board of the device and obtain root user privileges remotely. The researchers created a program run alongside legitimate software to manipulate access control systems at will.
Critical vulnerabilities
As mentioned, a total of eight zero-day vulnerabilities were detected in these systems. The most important flaw detected in this research received a score of 10/10 according to the Common Vulnerability Scoring System (CVSS) and its exploitation would allow remote code execution (RCE) attacks on the affected systems.
Below are all the faults detected:
| CVE | Summary | CVSS |
| CVE-2022-31479 | Unauthenticated command injection | 9.0/10 |
| CVE-2022-31480 | Denial of Service (DoS) condition | 7.5/10 |
| CVE-2022-31481 | Remote code execution (RCE) | 10/10 |
| CVE-2022-31486 | Authenticated command injection | 8.8/10 |
| CVE-2022-31482 | Unauthenticated DoS condition | 7.5/10 |
| CVE-2022-31483 | Arbitrary file writing | 9.1/10 |
| CVE-2022-31484 | Unauthenticated user modification | 7.5/10 |
| CVE-2022-31485 | Unauthenticated information spoofing | 5.3/10 |
Carrier has posted an alert on its product security page with detailed descriptions of these flaws, recommended mitigations, and firmware updates. Vendor patching should be the first course of action, whenever possible.
After publishing this research, it was confirmed that all OEM partners using Mercury boards could be exposed to these vulnerabilities. Customers using HID Global Mercury boards should contact their Mercury OEM partner to access security patches as soon as possible.
Inherent security risks
An IBM report published a few months ago points out that the average cost of a physical security commitment is $3.54 million USD, in addition to the fact that an average of 223 days is required to detect the compromise of an ICS solution, so the damage generated by the most insignificant intrusion could be disastrous for any organization.
This has not gone unnoticed by government agencies. According to the U.S. Cybersecurity and Infrastructure Security Agency (CISA), ICS and OT implementations represent complex security challenges, as the constant interaction with these technologies creates multiple exploitation opportunities for threat actors, which could even put operations in critical infrastructure at risk, creating chaos at all levels.
It is vitally important that ICS device administrators keep in mind that the vulnerabilities disclosed in this report can be highly damaging, even if individually the security risks seem minimal. It is not even necessary to imagine an attack scenario, since incidents like the one that occurred months ago in Colonial Pipeline are sufficient evidence of the devastation that a few chained vulnerabilities can cause.
Feel free to access the International Institute of Cyber Security (IICS) websites to learn more about information security risks, malware variants, vulnerabilities, and information technologies.
He is a cyber security and malware researcher. He studied Computer Science and started working as a cyber security analyst in 2006. He is actively working as an cyber security investigator. He also worked for different security companies. His everyday job includes researching about new cyber security incidents. Also he has deep level of knowledge in enterprise security implementation.