high-severity-flaw-reported-in-critical-system-used-by-oil-and-gas-companies

Share news article

Share on facebook
Share on twitter
Share on linkedin
Share on email

High-Severity Flaw Reported in Critical System Used by Oil and Gas Companies

Cybersecurity researchers have disclosed details of a new vulnerability in a system used across oil and gas organizations that could be exploited by an attacker to inject and execute arbitrary code.

The high-severity issue, tracked as CVE-2022-0902 (CVSS score: 8.1), is a path-traversal vulnerability in ABB Totalflow flow computers and remote controllers.

“Attackers can exploit this flaw to gain root access on an ABB flow computer, read and write files, and remotely execute code,” industrial security company Claroty said in a report shared with The Hacker News.

ABB, a Swedish-Swiss industrial automation firm, has since released firmware updates as of July 14, 2022, following responsible disclosure.

Flow computers are special-purpose electronic instruments used by petrochemical manufacturers to interpret data from flow meters and calculate and record the volume of substances such as natural gas, crude oils, and other hydrocarbon fluids at a specific point in time.

These gas measurements are critical not only when it comes to process safety, but are also used as inputs when bulk liquid or gas products change hands between parties, making it imperative that the flow readings are accurately captured.

In a nutshell, the vulnerability identified by Claroty is a path traversal flaw that exists in ABB’s implementation of its proprietary Totalflow TCP protocol, which is utilized to remotely configure the computers.

The issue, specifically, concerns a feature that allows for importing and exporting the configuration files, enabling an attacker to leverage an authentication bypass issue to get past the security passcode barrier and upload arbitrary files.

By taking advantage of the shortcoming, a remote malicious actor could seize control of the devices and hamper their ability to properly record oil and gas flow rates.

“A successful exploit of this issue could impede a company’s ability to bill customers, forcing a disruption of services, similar to the consequences suffered by Colonial Pipeline following its 2021 ransomware attack,” Claroty researcher Vera Mens said.


Found this article interesting? Follow THN on Facebook, Twitter and LinkedIn to read more exclusive content we post.

Related News

Nearly 500 million WhatsApp User Records Sold Online

Nearly 500 million WhatsApp User Records Sold Online

In what is becoming a rather common trend, a threat actor is claiming to sell 487 million WhatsApp users’ mobile…
How to Create ISO Files from Discs – 3 Best Ways

How to Create ISO Files from Discs – 3 Best Ways

An ISO file is a disk image of an optical disc. It is a single file that contains all the…
All You Need to Know About Emotet in 2022

All You Need to Know About Emotet in 2022

For 6 months, the infamous Emotet botnet has shown almost no activity, and now it’s distributing malicious spam. Let’s dive…