Unpatched Vulnerabilities Expose Novakon HMIs to Remote Hacking

"Researchers at CyberDanube, an IT/OT penetration testing and security consulting company, discovered that Novakon's HMIs are affected by five types of vulnerabilities. According to an advisory published by CyberDanube, the HMIs are affected by an unauthenticated buffer overflow allowing remote code execution with root privileges, a directory traversal that exposes files, and a couple of weak authentication issues that allow access to the device and applications. The security firm's researchers also discovered missing protection mechanisms and unnecessarily high permissions for certain processes."

"Sebastian Dietz, security researcher at CyberDanube, told SecurityWeek that the vulnerabilities can be exploited remotely without authentication. "An unauthenticated attacker could leverage these vulnerabilities to execute high privilege code on these devices," Dietz explained. "As HMI devices are used to interact with machines and systems (eg, PLCs, production lines) in critical infrastructure, gaining arbitrary code execution could have severe consequences.""

Novakon, a subsidiary of iBASE Technology, produces HMIs, industrial PCs, and IIoT solutions deployed across 18 countries and tens of thousands of units. CyberDanube identified five vulnerability types in Novakon HMIs, including an unauthenticated buffer overflow permitting remote root code execution, a directory traversal exposing files, weak authentication issues that allow device and application access, missing protection mechanisms, and overly high process permissions. The vulnerabilities can be exploited remotely without authentication and could impact machines and PLC-driven production lines in critical infrastructure. Novakon received the report but largely failed to provide feedback or issue patches, leaving exposure uncertain.

Read at SecurityWeek