Pepperl+Fuchs: HMI devices vulnerable to Meltdown and Spectre Attacks
Critical vulnerabilities within several CPUs have been identified by security researchers. These hardware vulnerabilities allow programs to learn about the contents of a system's memory, using side-channel attacks. Potential attack vectors against these vulnerabilities have been published and dubbed Meltdown and Spectre. While programs are typically not permitted to read data from the OS kernel or from other programs, a malicious program can exploit Meltdown and Spectre to get hold of secrets stored in kernel memory or the memory of other programs executed on the same CPU. As a consequence, an exploit could allow attackers to get access to any sensitive data, including passwords or cryptographic keys.
describes (3)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2017-5754US | medium5.6 | Exploit | ||
Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access v… | ||||
| CVE-2017-5753US | medium5.6 | Exploit | ||
Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side… | ||||
| CVE-2017-5715US | medium5.6 | Exploit | ||
Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access v… | ||||
references
External citations — patches, advisories, analysis.
remediations (9)
- FixedBox Thin Client BTC
Pepperl+Fuchs recommend users of their HMI devices of the VisuNet RM*, VisuNet PC* or Box Thin Client BTC* product families should follow these guidelines: Pepperl+Fuchs HMI devices should be segregated from enterprise networks and the Internet. Preconfigured server connections / websites should be restricted to secured and trusted servers. The use of secure protocols, e.g. HTTPS, is recommended. In case websites are configured in kiosk mode, it should be ensured that whitelisted websites do not redirect to untrusted servers / websites. For VisuNet RM* and Box Thin Client with Shell 4.x, update 18-33537, which includes Windows security updates published by Microsoft, is available on the Pepperl+Fuchs website. For VisuNet PC* systems with Microsoft Windows operating systems, Microsoft offers security updates, which can be downloaded from the Microsoft website. Please note that the Microsoft security updates directly affect machine code execution on the CPU. Users should be aware that installing these patches might negatively affect system performance and/or system stability. This advisory will be updated as further details and/or software updates become available.
- FixedBox Thin Client BTC
Pepperl+Fuchs recommend users of their HMI devices of the VisuNet RM*, VisuNet PC* or Box Thin Client BTC* product families should follow these guidelines: Pepperl+Fuchs HMI devices should be segregated from enterprise networks and the Internet. Preconfigured server connections / websites should be restricted to secured and trusted servers. The use of secure protocols, e.g. HTTPS, is recommended. In case websites are configured in kiosk mode, it should be ensured that whitelisted websites do not redirect to untrusted servers / websites. For VisuNet RM* and Box Thin Client with Shell 4.x, update 18-33537, which includes Windows security updates published by Microsoft, is available on the Pepperl+Fuchs website. For VisuNet PC* systems with Microsoft Windows operating systems, Microsoft offers security updates, which can be downloaded from the Microsoft website. Please note that the Microsoft security updates directly affect machine code execution on the CPU. Users should be aware that installing these patches might negatively affect system performance and/or system stability. This advisory will be updated as further details and/or software updates become available.
- FixedBox Thin Client BTC
Pepperl+Fuchs recommend users of their HMI devices of the VisuNet RM*, VisuNet PC* or Box Thin Client BTC* product families should follow these guidelines: Pepperl+Fuchs HMI devices should be segregated from enterprise networks and the Internet. Preconfigured server connections / websites should be restricted to secured and trusted servers. The use of secure protocols, e.g. HTTPS, is recommended. In case websites are configured in kiosk mode, it should be ensured that whitelisted websites do not redirect to untrusted servers / websites. For VisuNet RM* and Box Thin Client with Shell 4.x, update 18-33537, which includes Windows security updates published by Microsoft, is available on the Pepperl+Fuchs website. For VisuNet PC* systems with Microsoft Windows operating systems, Microsoft offers security updates, which can be downloaded from the Microsoft website. Please note that the Microsoft security updates directly affect machine code execution on the CPU. Users should be aware that installing these patches might negatively affect system performance and/or system stability. This advisory will be updated as further details and/or software updates become available.
- FixedVisuNet PC
Pepperl+Fuchs recommend users of their HMI devices of the VisuNet RM*, VisuNet PC* or Box Thin Client BTC* product families should follow these guidelines: Pepperl+Fuchs HMI devices should be segregated from enterprise networks and the Internet. Preconfigured server connections / websites should be restricted to secured and trusted servers. The use of secure protocols, e.g. HTTPS, is recommended. In case websites are configured in kiosk mode, it should be ensured that whitelisted websites do not redirect to untrusted servers / websites. For VisuNet RM* and Box Thin Client with Shell 4.x, update 18-33537, which includes Windows security updates published by Microsoft, is available on the Pepperl+Fuchs website. For VisuNet PC* systems with Microsoft Windows operating systems, Microsoft offers security updates, which can be downloaded from the Microsoft website. Please note that the Microsoft security updates directly affect machine code execution on the CPU. Users should be aware that installing these patches might negatively affect system performance and/or system stability. This advisory will be updated as further details and/or software updates become available.
- FixedVisuNet PC
Pepperl+Fuchs recommend users of their HMI devices of the VisuNet RM*, VisuNet PC* or Box Thin Client BTC* product families should follow these guidelines: Pepperl+Fuchs HMI devices should be segregated from enterprise networks and the Internet. Preconfigured server connections / websites should be restricted to secured and trusted servers. The use of secure protocols, e.g. HTTPS, is recommended. In case websites are configured in kiosk mode, it should be ensured that whitelisted websites do not redirect to untrusted servers / websites. For VisuNet RM* and Box Thin Client with Shell 4.x, update 18-33537, which includes Windows security updates published by Microsoft, is available on the Pepperl+Fuchs website. For VisuNet PC* systems with Microsoft Windows operating systems, Microsoft offers security updates, which can be downloaded from the Microsoft website. Please note that the Microsoft security updates directly affect machine code execution on the CPU. Users should be aware that installing these patches might negatively affect system performance and/or system stability. This advisory will be updated as further details and/or software updates become available.
- FixedVisuNet PC
Pepperl+Fuchs recommend users of their HMI devices of the VisuNet RM*, VisuNet PC* or Box Thin Client BTC* product families should follow these guidelines: Pepperl+Fuchs HMI devices should be segregated from enterprise networks and the Internet. Preconfigured server connections / websites should be restricted to secured and trusted servers. The use of secure protocols, e.g. HTTPS, is recommended. In case websites are configured in kiosk mode, it should be ensured that whitelisted websites do not redirect to untrusted servers / websites. For VisuNet RM* and Box Thin Client with Shell 4.x, update 18-33537, which includes Windows security updates published by Microsoft, is available on the Pepperl+Fuchs website. For VisuNet PC* systems with Microsoft Windows operating systems, Microsoft offers security updates, which can be downloaded from the Microsoft website. Please note that the Microsoft security updates directly affect machine code execution on the CPU. Users should be aware that installing these patches might negatively affect system performance and/or system stability. This advisory will be updated as further details and/or software updates become available.
- FixedVisuNet RM
Pepperl+Fuchs recommend users of their HMI devices of the VisuNet RM*, VisuNet PC* or Box Thin Client BTC* product families should follow these guidelines: Pepperl+Fuchs HMI devices should be segregated from enterprise networks and the Internet. Preconfigured server connections / websites should be restricted to secured and trusted servers. The use of secure protocols, e.g. HTTPS, is recommended. In case websites are configured in kiosk mode, it should be ensured that whitelisted websites do not redirect to untrusted servers / websites. For VisuNet RM* and Box Thin Client with Shell 4.x, update 18-33537, which includes Windows security updates published by Microsoft, is available on the Pepperl+Fuchs website. For VisuNet PC* systems with Microsoft Windows operating systems, Microsoft offers security updates, which can be downloaded from the Microsoft website. Please note that the Microsoft security updates directly affect machine code execution on the CPU. Users should be aware that installing these patches might negatively affect system performance and/or system stability. This advisory will be updated as further details and/or software updates become available.
- FixedVisuNet RM
Pepperl+Fuchs recommend users of their HMI devices of the VisuNet RM*, VisuNet PC* or Box Thin Client BTC* product families should follow these guidelines: Pepperl+Fuchs HMI devices should be segregated from enterprise networks and the Internet. Preconfigured server connections / websites should be restricted to secured and trusted servers. The use of secure protocols, e.g. HTTPS, is recommended. In case websites are configured in kiosk mode, it should be ensured that whitelisted websites do not redirect to untrusted servers / websites. For VisuNet RM* and Box Thin Client with Shell 4.x, update 18-33537, which includes Windows security updates published by Microsoft, is available on the Pepperl+Fuchs website. For VisuNet PC* systems with Microsoft Windows operating systems, Microsoft offers security updates, which can be downloaded from the Microsoft website. Please note that the Microsoft security updates directly affect machine code execution on the CPU. Users should be aware that installing these patches might negatively affect system performance and/or system stability. This advisory will be updated as further details and/or software updates become available.
- FixedVisuNet RM
Pepperl+Fuchs recommend users of their HMI devices of the VisuNet RM*, VisuNet PC* or Box Thin Client BTC* product families should follow these guidelines: Pepperl+Fuchs HMI devices should be segregated from enterprise networks and the Internet. Preconfigured server connections / websites should be restricted to secured and trusted servers. The use of secure protocols, e.g. HTTPS, is recommended. In case websites are configured in kiosk mode, it should be ensured that whitelisted websites do not redirect to untrusted servers / websites. For VisuNet RM* and Box Thin Client with Shell 4.x, update 18-33537, which includes Windows security updates published by Microsoft, is available on the Pepperl+Fuchs website. For VisuNet PC* systems with Microsoft Windows operating systems, Microsoft offers security updates, which can be downloaded from the Microsoft website. Please note that the Microsoft security updates directly affect machine code execution on the CPU. Users should be aware that installing these patches might negatively affect system performance and/or system stability. This advisory will be updated as further details and/or software updates become available.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan