Pepperl+Fuchs: HMI devices vulnerable to Meltdown and Spectre Attacks

Impact
Pepperl+Fuchs analysed their HMI products in respect of the Meltdown and Spectre attacks. To the vendor's current knowledge, their VisuNet and Box Thin Client HMI devices, based on an Intel® CPU, are potentially affected by these vulnerabilities.

In order to exploit these vulnerabilities, an attacker needs to be able to execute arbitrary code on the CPU of the target system.

Since Pepperl+Fuchs HMI devices are designed and intended to be used in Industrial Control System networks, typically these devices are segregated from enterprise networks and do not have direct internet access. Additionally, VisuNet HMI devices use a kiosk mode for normal operation. Within this mode access policies of thin client based VisuNet Remote Monitors and Box Thin Clients are restricted, such that users can only access predefined servers. This implies that outgoing connections and local software installations have to be configured by administrators. Hence, operators are restricted in a way such that they can only use the system as configured by administrators. If these steps are taken, this greatly reduces the risk of unwittingly accessing malicious content and executing unknown code, e.g. by accessing a website that was prepared by an attacker.

However, if a malicious website is accessed, the attacker could gain knowledge of all data in the memory of the HMI device, including passwords.

Remediation
Pepperl+Fuchs recommend users of their HMI devices of the VisuNet RM*, VisuNet PC* or Box Thin Client BTC* product families should follow these guidelines:

Pepperl+Fuchs HMI devices should be segregated from enterprise networks and the Internet.
Preconfigured server connections / websites should be restricted to secured and trusted servers. The use of secure protocols, e.g. HTTPS, is recommended.
In case websites are configured in kiosk mode, it should be ensured that whitelisted websites do not redirect to untrusted servers / websites.
For VisuNet RM* and Box Thin Client with Shell 4.x, update 18-33537, which includes Windows security updates published by Microsoft, is available on the Pepperl+Fuchs website.
For VisuNet PC* systems with Microsoft Windows operating systems, Microsoft offers security updates, which can be downloaded from the Microsoft website.
Please note that the Microsoft security updates directly affect machine code execution on the CPU. Users should be aware that installing these patches might negatively affect system performance and/or system stability.
This advisory will be updated as further details and/or software updates become available.