Skip to content
OpenAdvisories
Critical 1 exploited CVE VDE-2019-011 3 CVEs

Pepperl+Fuchs: Remote code execution vulnerability in HMI devices

Published May 29, 2019 · Updated Oct 7, 2019 · Revision 2

Vendor: Microsoft Vendor: Pepperl+Fuchs Product: Box Thin Client BTC Product: RDS disabled Product: RM Shell 3 Product: RM Shell 4 Product: RM Shell 5 Product: VisuNet PC Product: VisuNet RM Product: Windows 10 Product: Windows 7 Product: Windows XP Product: Windows XP Embedded

Summary

A remote code execution vulnerability exists in **Remote Desktop Services** – formerly known as **Terminal Services** – when an unauthenticated attacker connects to the target system using **RDP** and sends specially crafted requests.
This vulnerability is **pre-authentication** and requires **no user interaction**.
An attacker who successfully exploits this vulnerability could execute arbitrary code on the target system.

To exploit this vulnerability, an attacker would need to send a specially crafted request to the target system's Remote Desktop Service via **RDP**.

### Microsoft Advisories

- [CVE-2019-0708](https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708)
- [CVE-2019-1181](https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1181)
- [CVE-2019-1182](https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1182)

Details

Impact
- **VisuNet RM Shell 3 devices** based on a **Windows XP Embedded** system do not contain Remote Desktop Services.
→ Therefore, this vulnerability could not be used by an attacker.

- **VisuNet RM Shell 4 devices** have Remote Desktop Services **disabled by default**.
→ The vulnerability could only be exploited if the device Administrator **enabled** Remote Desktop Services **after commissioning**.

- **VisuNet PC devices** with **Windows XP, Windows 7, or Windows 10**
→ It should be verified whether Remote Desktop Services are **disabled**.

- **Systems with enabled Network Level Authentication (NLA)**
→ Are only **partially affected**, as NLA requires authentication **before** the vulnerability can be triggered.
→ However, these systems are still **vulnerable to Remote Code Execution (RCE)** if the attacker has **valid credentials**.

Remediation
Customers using **Pepperl+Fuchs HMI devices** out of **VisuNet RM\***, **VisuNet PC\*** or **Box Thin Client BTC\*** product families should follow these guidelines:

- **Devices running Windows XP, Windows 7 or Windows 10**
→ Should be updated using the Windows Update mechanism.

- **Devices running RM Shell 4 with enabled Remote Desktop Services**
→ Should be updated with the newest **RM Image 4 Security Patches 01/2017 to 09/2019 (18-33400G)**:
[https://www.pepperl-fuchs.com/cgi-bin/db/doci.pl/?ShowDocByDocNo=18-33400](https://www.pepperl-fuchs.com/cgi-bin/db/doci.pl/?ShowDocByDocNo=18-33400)
*Note: For RM Shell 4 devices with disabled Remote Desktop Services (default commissioning state), this update is optional but recommended.*

- **Devices running RM Shell 5 with enabled Remote Desktop Services**
→ Should be updated with **RM Image 5 Security Patches 09/2019 (18-33624E)**:
[https://www.pepperl-fuchs.com/cgi-bin/db/doci.pl/?ShowDocByDocNo=18-33624](https://www.pepperl-fuchs.com/cgi-bin/db/doci.pl/?ShowDocByDocNo=18-33624)
*Note: For RM Shell 5 devices with disabled Remote Desktop Services (default commissioning state), this update is optional but recommended.*

For support, please contact your local Pepperl+Fuchs sales representative.

Vulnerabilities 3

Revision history

  1. #1.1.0

    The summary section was updated to include references to the newly relevant vulnerabilities CVE-2019-1181 and CVE-2019-1182. A previously included statement claiming that "VisuNet RM Shell 5 devices and VisuNet PC devices running Windows 10 are not affected by this vulnerability" was removed from the Impact section, as this information could no longer be confirmed. Additionally, information regarding RM Shell 5 devices was added to the Solution section to provide updated mitigation guidance.

  2. #1.0.0

    Initial revision.

References