===========================================================================
             AUSCERT External Security Bulletin Redistribution             
                                                                           
                               ESB-2024.1997                               
           ICS Advisory | ICSA-24-093-01 IOSIX IO-1020 Micro ELD           
                               3 April 2024                                
                                                                           
===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           IOSIX IO-1020 Micro ELD                                 
Publisher:         ICS-CERT                                                
Operating System:  Network Appliance                                       
Resolution:        Patch/Upgrade                                           
CVE Names:         CVE-2024-30210 CVE-2024-31069 CVE-2024-28878            

Original Bulletin:
   https://www.cisa.gov/news-events/ics-advisories/icsa-24-093-01

Comment: CVSS (Max):  9.6 CVE-2024-28878 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
         CVSS Source: ICS-CERT                                             
         Calculator:  https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H


- --------------------------BEGIN INCLUDED TEXT--------------------

ICS Advisory (ICSA-24-093-01)

IOSIX IO-1020 Micro ELD

Release Date
April 02, 2024

1. EXECUTIVE SUMMARY

  o CVSS v4 9.4
  o ATTENTION : Exploitable from adjacent network/Low attack complexity
  o Vendor : IOSiX
  o Equipment : IO-1020 Micro ELD
  o Vulnerabilities : Use of Default Credentials, Download of Code Without
    Integrity Check

2. RISK EVALUATION

Successful exploitation of these vulnerabilities could allow an adjacent
attacker to take control of vehicle systems by connecting to and modifying the
affected device.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following IOSiX products are affected:

  o IO-1020 Micro ELD: Versions prior to 360

3.2 Vulnerability Overview

3.2.1 USE OF DEFAULT CREDENTIALS CWE-1392

IO-1020 Micro ELD uses a default WIFI password that could allow an adjacent
attacker to connect to the device.

CVE-2024-30210 has been assigned to this vulnerability. A CVSS v3.1 base score
of 7.4 has been calculated; the CVSS vector string is ( AV:A/AC:L/PR:N/UI:N/S:C
/C:H/I:N/A:N ).

A CVSS v4 score has also been calculated for CVE-2024-30210 . A base score of
8.5 has been calculated; the CVSS vector string is ( CVSS4.0/AV:A/AC:L/AT:N/
PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H ).

3.2.2 USE OF DEFAULT CREDENTIALS CWE-1392

Web server uses a default password for authentication.

CVE-2024-31069 has been assigned to this vulnerability. A CVSS v3.1 base score
of 7.4 has been calculated; the CVSS vector string is ( AV:A/AC:L/PR:N/UI:N/S:C
/C:H/I:N/A:N ).

A CVSS v4 score has also been calculated for CVE-2024-31069 . A base score of
8.5 has been calculated; the CVSS vector string is ( CVSS4.0/AV:A/AC:L/AT:N/
PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H ).

3.2.3 DOWNLOAD OF CODE WITHOUT INTEGRITY CHECK CWE-494

IO-1020 Micro ELD downloads source code or an executable from an adjacent
location and executes the code without sufficiently verifying the origin or
integrity of the code.

CVE-2024-28878 has been assigned to this vulnerability. A CVSS v3.1 base score
of 9.6 has been calculated; the CVSS vector string is ( AV:A/AC:L/PR:N/UI:N/S:C
/C:H/I:H/A:H ).

A CVSS v4 score has also been calculated for CVE-2024-28878 . A base score of
9.4 has been calculated; the CVSS vector string is ( CVSS4.0/AV:A/AC:L/AT:N/
PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H ).

3.3 BACKGROUND

  o CRITICAL INFRASTRUCTURE SECTORS: Transportation
  o COUNTRIES/AREAS DEPLOYED: North America
  o COMPANY HEADQUARTERS LOCATION: United States

3.4 RESEARCHER

Jake Jepson of Colorado State University reported these vulnerabilities to
CISA.

4. MITIGATIONS

IOSIX recommends users update to 360.

For further support, contact IOSiX .

CISA recommends users take defensive measures to minimize the risk of
exploitation of these vulnerabilities, such as:

  o Minimize network exposure for all control system devices and/or systems,
    ensuring they are not accessible from the internet .

CISA reminds organizations to perform proper impact analysis and risk
assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices
on the ICS webpage on cisa.gov/ics . Several CISA products detailing cyber
defense best practices are available for reading and download, including
Improving Industrial Control Systems Cybersecurity with Defense-in-Depth
Strategies .

CISA encourages organizations to implement recommended cybersecurity strategies
for proactive defense of ICS assets .

Additional mitigation guidance and recommended practices are publicly available
on the ICS webpage at cisa.gov/ics in the technical information paper,
ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation
Strategies .

Organizations observing suspected malicious activity should follow established
internal procedures and report findings to CISA for tracking and correlation
against other incidents.

No known public exploitation specifically targeting these vulnerabilities has
been reported to CISA at this time. These vulnerabilities are not exploitable
remotely.

5. UPDATE HISTORY

  o April 2, 2024: Initial Publication

This product is provided subject to this Notification and this Privacy & Use 
policy.

- --------------------------END INCLUDED TEXT----------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================