CISA Warns Of Critical Veeder-Root Vulnerabilities Let Attackers Execute System-level Commands

Cybersecurity: Veeder-Root TLS4B Vulnerabilities

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an advisory regarding two significant vulnerabilities in Veeder-Root’s TLS4B Automatic Tank Gauge System, a vital component in fuel storage and management within the energy sector.

Vulnerability Implications

The identified vulnerabilities could allow attackers to execute arbitrary system-level commands on affected devices, leading to potential disruptions in critical infrastructure. The primary vulnerability has a CVSS v4 score of 9.4, indicating its high exploitability with low complexity, particularly for attackers possessing basic credentials.

According to researcher Pedro Umbelino of Bitsight, Veeder-Root advises immediate system upgrades to mitigate these risks. The vulnerabilities originate from flaws in the system’s command and time value handling, exposing Linux-based consoles to potential manipulation. These issues highlight persistent challenges in securing industrial control systems (ICS) against complex threats.

Technical Details

The TLS4B system, in versions prior to 11.A, is affected by a command injection flaw and an integer overflow related to the 2038 Unix epoch problem.

• Command Injection (CWE-77): This vulnerability occurs in the SOAP-based web services interface, allowing authenticated remote attackers to inject malicious elements and execute Linux shell commands. This can result in full system access, data theft, or further network compromise.
• Integer Overflow (CWE-190): This issue mishandles time values beyond the 2038 rollover, resetting the clock to 1901 and causing authentication failures, log corruption, and halted leak detection. Attackers could exploit this for denial-of-service (DoS) by altering system time, locking out administrators, and disrupting operations.

Mitigation Strategies

Exploitation of these vulnerabilities could lead to remote command execution, lateral movement, administrative lockouts, and denial-of-service conditions, significantly affecting energy infrastructure reliability. The low barriers to entry, requiring only valid credentials, increase risks for unpatched systems.

Veeder-Root recommends upgrading to TLS4B version 11.A to address the command injection flaw. For the integer overflow issue, a patch is forthcoming, and users should adhere to network security best practices, such as isolating devices and securing ports.

CISA advises minimizing internet exposure, deploying firewalls, and utilizing VPNs for remote access while conducting thorough risk assessments.