Emerson OpenBSI through 2022-04-29 mishandles credential storage. It is an engineering environment for the ControlWave and Bristol Babcock line of RTUs. This environment provides access control functionality through user authentication and privilege management. The credentials for various users are stored insecurely in the SecUsers.ini file by using a simple string transformation rather than a cryptographic mechanism.

Threat-Mapped Scoring

Score: 0.0

Priority: Unclassified

EPSS

Score: 0.0005
Percentile: 0.15518

CVSS Scoring

Mapped CWE(s)

• CWE-522 : Insufficiently Protected Credentials

All CAPEC(s)

CAPEC(s) with Mapped TTPs

Mapped ATT&CK TTPs

• T1552.004 : Private Keys
  Kill Chain: credential-access
• T1558.003 : Kerberoasting
  Kill Chain: credential-access
• T1543 : Create or Modify System Process
  Kill Chain: persistence
• T1021 : Remote Services
  Kill Chain: lateral-movement
• T1114.002 : Remote Email Collection
  Kill Chain: collection
• T1133 : External Remote Services
  Kill Chain: persistence
• T1078 : Valid Accounts
  Kill Chain: defense-evasion
• T1021.002 : SMB/Windows Admin Shares
  Kill Chain: lateral-movement
• T1110.004 : Credential Stuffing
  Kill Chain: credential-access
• T1550.002 : Pass the Hash
  Kill Chain: defense-evasion
• T1550.003 : Pass the Ticket
  Kill Chain: defense-evasion
• T1558 : Steal or Forge Kerberos Tickets
  Kill Chain: credential-access

Malware

APTs Threat Group Associations

Campaigns

Affected Products

• cpe:2.3:a:emerson:openbsi:*:*:*:*:*:*:*:*
• cpe:2.3:a:emerson:openbsi:5.9:-:*:*:*:*:*:*
• cpe:2.3:a:emerson:openbsi:5.9:sp1:*:*:*:*:*:*
• cpe:2.3:a:emerson:openbsi:5.9:sp2:*:*:*:*:*:*
• cpe:2.3:a:emerson:openbsi:5.9:sp3:*:*:*:*:*:*

← Back to Home