OmniMetrix OmniView Vulnerabilities
All information products included in http://ics-cert.us-cert.gov are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see http://www.us-cert.gov/tlp/.
Bill Voltmer of Elation Technologies LLC has identified vulnerabilities in OmniMetrix’s OmniView web application. OmniMetrix has produced a new software version for its web interface that mitigates these vulnerabilities.
These vulnerabilities could be exploited remotely.
The following OmniView versions are affected:
- OmniView, Version 1.2
Exploiting these vulnerabilities could compromise account credentials that may allow an attacker to control the operation of backup generators connected to the compromised account.
Impact to individual organizations depends on many factors that are unique to each organization. NCCIC/ICS-CERT recommends that organizations evaluate the impact of these vulnerabilities based on their operational environment, architecture, and product implementation.
OmniMetrix is a US-based company that is headquartered in Buford, Georgia.
The affected web interface, OmniView, is a data management control center that is used to monitor and control backup generators. OmniView is only accessible from OmniMetrix’s web site. According to OmniMetrix, its services are deployed across several sectors including Commercial Facilities and Energy. OmniMetrix estimates that its services are primarily used in the United States with a small number of users in Europe, Asia, and South America.
CLEARTEXT TRANSMISSION OF SENSITIVE INFORMATIONa
The OmniView web application transmits credentials with the HTTP protocol, which could be sniffed by an attacker that may result in the compromise of account credentials.
WEAK PASSWORD REQUIREMENTSd
Insufficient password requirements for the OmniView web application may allow an attacker to gain access by brute forcing account passwords.
These vulnerabilities could be exploited remotely.
EXISTENCE OF EXPLOIT
No known public exploits specifically target these vulnerabilities.
An attacker with low skill would be able to exploit these vulnerabilities.
OmniMetrix has deployed a new version of OmniView software that resolves the reported vulnerabilities. OmniMetrix reports that it has implemented the use of HTTPS protocol and enforces strong password requirements. When OmniMetrix’s users log into the OmniMetrix web site, they will be prompted to change passwords. OmniMetrix recommends that users log into their accounts as soon as possible to change their passwords:
For additional information about the new version of OmniView, contact OmniMetrix at:
ICS-CERT also provides a section for control systems security recommended practices on the ICS-CERT web page at: http://ics-cert.us-cert.gov/content/recommended-practices. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Additional mitigation guidance and recommended practices are publicly available in the ICS‑CERT Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies, that is available for download from the ICS-CERT web site (http://ics-cert.us-cert.gov/).
Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to ICS-CERT for tracking and correlation against other incidents.
- a. CWE-319: Cleartext Transmission of Sensitive Information, http://cwe.mitre.org/data/definitions/319.html, web site last accessed December 15, 2016.
- b. NVD, http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-5786, NIST uses this advisory to create the CVE web site report. This web site will be active sometime after publication of this advisory.
- c. CVSS Calculator, https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S..., web site last accessed December 15, 2016.
- d. CWE-521: Weak Password Requirements, http://cwe.mitre.org/data/definitions/521.html, web site last accessed December 15, 2016.
- e. NVD, http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-5801, NIST uses this advisory to create the CVE web site report. This web site will be active sometime after publication of this advisory.
- f. CVSS Calculator, https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S..., web site last accessed December 15, 2016.
For any questions related to this report, please contact the NCCIC at:
Toll Free: 1-888-282-0870
The NCCIC continuously strives to improve its products and services. You can help by choosing one of the links below to provide feedback about this product.