Wind River VxWorks TCP Sequence Number Predictability Vulnerability (CVE-2015-3963) Advisory

Wind River VXWorks TCP Predictability Vulnerability in ICS Devices (Update B) Overview Alert Code: ICSA-15-169-01B Last Revised: February 04, 2016 Researchers: Raheem Beyah, David Formby, and San Shin Jung Source of Research: Georgia Tech and relevant centers Vulnerability: Predictable TCP sequence vulnerability in VXWorks embedded software. This flaw allows an attacker to predict TCP sequence numbers, potentially enabling session hijacking or man-in-the-middle attacks on networked industrial control systems (ICS) devices. Affected Products VXWorks VxWorks: - Version 7 - Version 6.9 releases (prior to 6.9.4.4) - Version 6.8 releases (prior to 6.8.3) - Version 6.7 releases (prior to 6.7.1.1) - Version 6.6 and all earlier versions (excluding 5.5.1 with PNE2.2 and versions 6.0 through 6.4) VxWorks Cert: - Version 6.6.3 - Version 6.6.4 - Version 6.6.4.1 VxWorks 653: - Multiple versions of VxWorks 653 Platform-specific products are affected. Specific versions not detailed, but the vulnerability impacts platform-specific implementations. Schneider Electric SAGE RTUs Affected models include: - 1210 RTU - 1230 RTU - Other SAGE RTU models utilizing CPU cards such as C3412 These devices are commonly deployed in critical infrastructure environments (e.g., energy, water, transportation) and rely on VxWorks for real-time operations. Vulnerability Details CVE: CVE-2015-3963 (NVD) CVSS v2 Base Score: 5.8 (Medium severity) - Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N - Impact: Partial confidentiality, integrity, and no availability impact Exploitability: - Can be exploited remotely - Requires medium skill level - No authentication required Attack Scenario: - An attacker can predict TCP sequence numbers used by the target system, enabling session hijacking or injection of malicious data into existing TCP connections. - This is particularly dangerous in ICS environments where communication is often unencrypted and relies on predictable protocols. Affected Schneider Electric Models: - Multiple SAGE RTU models that utilize CPU cards (e.g., C3412) running vulnerable versions of VxWorks. These devices are used in remote terminal units for monitoring and controlling field devices in industrial networks. Mitigation Vendor Patches: - Wind River has released security patches for affected versions of VxWorks and VxWorks Cert. - Users are advised to download and install the latest patched versions from the official Wind River website: https://www.windriver.com Upgrade Recommendations: - Asset owners should upgrade to newer, patched versions of VxWorks and VxWorks Cert to eliminate the vulnerability. Network Security Controls (ICS-CERT Recommendations): - Implement network segmentation and firewalls to restrict unauthorized access to ICS devices. - Deploy intrusion detection and prevention systems (IDS/IPS) to monitor for suspicious network activity. - Use secure communication protocols (e.g., TLS) where possible to protect data in transit. - Conduct regular vulnerability assessments and penetration testing of ICS environments. Operational Best Practices: - Limit exposure of ICS devices to the internet or untrusted networks. - Apply the principle of least privilege to network access. - Monitor logs for unusual connection patterns or unauthorized session establishment. --- Note: This vulnerability highlights the importance of securing embedded systems in critical infrastructure. While patches are available, deployment in legacy or field-deployed systems may be challenging due to operational constraints. Organizations should prioritize risk assessment and phased remediation.

Goal Reached Thanks to every supporter — we hit 100%!

Wind River VxWorks TCP Sequence Number Predictability Vulnerability (CVE-2015-3963) Advisory