OmniMetrix OmniView Vulnerabilities

OVERVIEW

Bill Voltmer of Elation Technologies LLC has identified vulnerabilities in OmniMetrix’s OmniView web application. OmniMetrix has produced a new software version for its web interface that mitigates these vulnerabilities.

These vulnerabilities could be exploited remotely.

AFFECTED PRODUCTS

The following OmniView versions are affected:

• OmniView, Version 1.2

IMPACT

Exploiting these vulnerabilities could compromise account credentials that may allow an attacker to control the operation of backup generators connected to the compromised account.

Impact to individual organizations depends on many factors that are unique to each organization. NCCIC/ICS-CERT recommends that organizations evaluate the impact of these vulnerabilities based on their operational environment, architecture, and product implementation.

BACKGROUND

OmniMetrix is a US-based company that is headquartered in Buford, Georgia.

The affected web interface, OmniView, is a data management control center that is used to monitor and control backup generators. OmniView is only accessible from OmniMetrix’s web site. According to OmniMetrix, its services are deployed across several sectors including Commercial Facilities and Energy. OmniMetrix estimates that its services are primarily used in the United States with a small number of users in Europe, Asia, and South America.

VULNERABILITY CHARACTERIZATION

VULNERABILITY OVERVIEW

The OmniView web application transmits credentials with the HTTP protocol, which could be sniffed by an attacker that may result in the compromise of account credentials.

CVE-2016-5786NVD, http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-5786, NIST uses this advisory to create the CVE web site report. This web site will be active sometime after publication of this advisory. has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).CVSS Calculator, https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, web site last accessed December 15, 2016.

Insufficient password requirements for the OmniView web application may allow an attacker to gain access by brute forcing account passwords.

CVE-2016-5801NVD, http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-5801, NIST uses this advisory to create the CVE web site report. This web site will be active sometime after publication of this advisory. has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).CVSS Calculator, https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, web site last accessed December 15, 2016.

VULNERABILITY DETAILS

EXPLOITABILITY

These vulnerabilities could be exploited remotely.

EXISTENCE OF EXPLOIT

No known public exploits specifically target these vulnerabilities.

DIFFICULTY

An attacker with low skill would be able to exploit these vulnerabilities.

MITIGATION

OmniMetrix has deployed a new version of OmniView software that resolves the reported vulnerabilities. OmniMetrix reports that it has implemented the use of HTTPS protocol and enforces strong password requirements. When OmniMetrix’s users log into the OmniMetrix web site, they will be prompted to change passwords. OmniMetrix recommends that users log into their accounts as soon as possible to change their passwords:

https://webdata.omnimetrix.net/omxphp/omxLogin.php

For additional information about the new version of OmniView, contact OmniMetrix at:

https://www.omnimetrix.net/en/support/customer-support/

ICS-CERT also provides a section for control systems security recommended practices on the ICS-CERT web page at: http://ics-cert.us-cert.gov/content/recommended-practices. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

Additional mitigation guidance and recommended practices are publicly available in the ICS‑CERT Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies, that is available for download from the ICS-CERT web site (http://ics-cert.us-cert.gov/).

Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to ICS-CERT for tracking and correlation against other incidents.

• OmniMetrix