ICS Vulnerabilities Chained for Deep Lateral Movement and Physical Damage 

Researchers at cybersecurity firm Forescout have shown how various vulnerabilities discovered in recent years in industrial control systems (ICS) can be chained for deep lateral movement in operational technology (OT) networks, and even to cause significant physical damage.

Two vulnerabilities found last year in Schneider Electric’s Modicon programmable logic controllers (PLCs) are at the center of this research. The security holes can be exploited for remote code execution (CVE-2022-45788) and authentication bypass (CVE-2022-45789), and they were addressed by the industrial giant in January. 

The issues were actually discovered as part of Forescout’s OT:Icefall research, which led to the discovery of dozens of flaws across the products of several major vendors. However, Schneider had asked the security firm not to disclose these two vulnerabilities when it made the OT:Icefall research public. 

The Modicon PLC vulnerabilities can be chained with known security flaws in products from other vendors for an exploit that enables deep lateral movement in an OT network. 

Deep lateral movement can be useful to sophisticated attackers, as it allows them to gain access to ICS that might otherwise be difficult to reach. In addition, it can allow threat actors to gain granular control over industrial devices.

[ Read: Cyber Insights 2023 | ICS and Operational Technology ]

In order to demonstrate the impact of its research, Forescout showed how hackers could target the systems that power a movable bridge. The company said this type of attack would be very difficult to carry out by an attacker who has simple control over a supervisory control and data acquisition (SCADA) interface.