Summary
Successful exploitation of these vulnerabilities could allow a nearby attacker to execute diagnostic functions in the trailer or light the trailer ABS fault telltale in a tractor. Please see the NMFTA disclosure letter at for more details.
Vulnerabilities 2
-
Critical 9.3
ICSA-22-063-01 Improper Protection against Electromagnetic Fault Injection in Trailer Power Line Communications (PLC) J2497
Power Line Communications PLC4TRUCKS J2497 trailer receivers are susceptible to remote RF induced signals.
-
Medium 6.1
ICSA-22-063-01 Missing Authentication for Critical Function in Trailer Power Line Communications (PLC) J2497
Power Line Communications PLC4TRUCKS J2497 trailer brake controllers implement diagnostic functions which can be invoked by replaying J2497 messages. There is no authentication or authorization for these functions.
Revision history
-
#1
ICSA-22-063-01 Trailer Power Line Communications J2497
References
-
ICS Advisory ICSA-22-063-01 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-22-063-01
-
Recommended Practices
https://www.cisa.gov/uscert/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B