#Micom s1 v2 data model update#
#Micom s1 v2 data model software#
#Micom s1 v2 data model windows#

Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. ICS-CERT also provides a section for control systems security recommended practices on the ICS-CERT Web page.

When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing that VPN is only as secure as the connected devices.

Locate control system networks and remote devices behind firewalls, and isolate them from the business network.

Critical devices should not directly face the Internet.

Minimize network exposure for all control system devices.

ICS CERT encourages asset owners to take additional defensive measures to protect against this and other cybersecurity risks.

#Micom s1 v2 data model update#

The update can be obtained through the Alstom Grid Contact Centre at: or by phone at: +44 1785 25 0070. MITIGATIONДЄlstom has released MiCOM S1 Agile version v1.0.3 that mitigates the vulnerability by controlling which users can access MiCOM S1 Agile files and services. DIFFICULTYДЄn attacker with a high skill would be able to exploit this vulnerability. No known public exploits specifically target this vulnerability. This vulnerability is not exploitable remotely and cannot be exploited without access to the local system by an authorized user. A CVSS v2 base score of 6.0 has been assigned the CVSS vector string is (AV:L/AC:H/Au:S/C:C/I:C/A:C). Replacing the associated executable, in this case, would allow lower privileged users to escalate their privileges to an administrator level on the system.

#Micom s1 v2 data model windows#

In addition, a Windows Service running under LocalSystem is located within this directory as well. Successful exploitation of this vulnerability could cause loss of availability, integrity, and confidentiality with the local system and a disruption in communications with other connected devices.

When the MiCOM S1 application is run, the malicious executable would be run instead. A malicious user with any level of access to the local system could replace executables within the MiCOM S1 Program Files directory with malicious files.

#Micom s1 v2 data model software#

The MiCOM S1 Software does not limit user access to its installed executables to only authenticated administrative users. VULNERABILITY CHARACTERIZATION VULNERABILITY OVERVIEW According to Alstom, MiCOM S1 Software is deployed across the energy sector. The affected products, Alstom Grid MiCOM S1 Agile and Studio Software, allows users to configure Alstom GridвЂ™s range of protective relays. BACKGROUNDДЄlstom Grid is a global company that maintains offices in several countries around the world, including the US, UK, Canada, Italy, India, Brazil, France, Russia, Saudi Arabia, United Arab Emirates and Singapore. ICSвЂ‘CERT recommends that organizations evaluate the impact of this vulnerability based on their operational environment, architecture, and product implementation. Impact to individual organizations depends on many factors that are unique to each organization.

This vulnerability can affect products deployed in the energy, dams, healthcare and public health, water, chemical, and commercial facilities. Unauthorized attackers can then access the MiCOM S1 executable files. Successful exploitation of this vulnerability may allow an attacker with read/modify user permissions for the MiCOM S1 file system to affect the availability of the application.

Legacy MiCOM S1 Studio Software, all versions.

MiCOM S1 Agile Software, all versions up to and including v1.0.2, and.

The following Alstom Grid products are affected: Alstom has tested the update to validate that it resolves the vulnerability. Alstom has produced an update that mitigates this vulnerability. This advisory only addresses the Alstom software product.ДЄlstom has identified an improper authorization vulnerability in the Alstom Grid MiCOM S1 Agile Software. A user could have MiCOM S1 Studio Software from a different vendor. Note: Alstom Grid MiCOM S1 Studio Software is its own software suite. This advisory provides mitigation details for a vulnerability affecting the Alstom Grid MiCOM S1 Agile and S1 Studio Software.