CVE-2023-3323 : Security Advisory and Response

This article provides detailed information about CVE-2023-3323, which relates to a vulnerability found in ABB Ability™ zenon.

Understanding CVE-2023-3323

CVE-2023-3323 involves a security flaw that allows low-privileged users to read and update data in various directories used by the Zenon system. Attackers could exploit this vulnerability by using specially crafted programs to run on Zenon installed hosts.

What is CVE-2023-3323?

The vulnerability in CVE-2023-3323 allows low-privileged users to access and modify data in directories used by the Zenon system, potentially leading to unauthorized access and data manipulation.

The Impact of CVE-2023-3323

The impact of CVE-2023-3323 is classified as medium severity. An attacker exploiting this vulnerability could potentially execute code through overwriting project files on the Zenon engineering studio system, compromising the integrity and availability of the affected systems.

Technical Details of CVE-2023-3323

CVE-2023-3323 is identified as having a CVSS v3.1 base score of 5.9, with a medium severity level. The attack complexity is high, the attack vector is physical, and the confidentiality impact is low. The vulnerability requires low privileges to exploit, impacting the integrity and availability of the system.

Vulnerability Description

The vulnerability allows low-privileged users to read and update data in various directories of the Zenon system, potentially leading to unauthorized access and data manipulation.

Affected Systems and Versions

This vulnerability affects ABB Ability™ zenon versions from 11 build through 11 build 106404.

Exploitation Mechanism

Attackers can exploit this vulnerability by utilizing specially crafted programs to run on Zenon installed hosts, enabling them to read and update data in directories used by the system.

Mitigation and Prevention

To mitigate the risks associated with CVE-2023-3323, several steps can be taken to enhance the security of the affected systems:

Immediate Steps to Take

Physically protect process control systems.
Ensure systems have no direct connections to the internet.
Separate systems from other networks using a firewall system with minimal exposed ports.
Remove default directory permissions for specific directories and provide access only to expected users.
Install IIoT services on a separate system.
Secure relevant executable files and manage access permissions for directories.

Long-Term Security Practices

Establishing security best practices such as regular security assessments, training employees on cybersecurity awareness, and implementing robust access control measures can help prevent similar vulnerabilities in the future.

Patching and Updates

Stay updated on security patches and updates provided by ABB for the Zenon system to address and resolve the vulnerability identified in CVE-2023-3323. Regularly apply patches and updates to ensure the system's security integrity.

Taking proactive measures to secure systems and implementing recommended practices can help prevent exploitation of CVE-2023-3323 and enhance overall cybersecurity posture.