U.S. Flag Official website of the Department of Homeland Security
U.S. Department of Homeland Security Seal. ICS-CERT. Industrial Control Systems Cyber Emergency Response Team.
TLP:WHITE

Advisory (ICSA-16-350-02)

OmniMetrix OmniView Vulnerabilities

Original release date: December 15, 2016

Legal Notice

All information products included in http://ics-cert.us-cert.gov are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see http://www.us-cert.gov/tlp/.



OVERVIEW

Bill Voltmer of Elation Technologies LLC has identified vulnerabilities in OmniMetrix’s OmniView web application. OmniMetrix has produced a new software version for its web interface that mitigates these vulnerabilities.

These vulnerabilities could be exploited remotely.

AFFECTED PRODUCTS

The following OmniView versions are affected:

  • OmniView, Version 1.2

IMPACT

Exploiting these vulnerabilities could compromise account credentials that may allow an attacker to control the operation of backup generators connected to the compromised account.

Impact to individual organizations depends on many factors that are unique to each organization. NCCIC/ICS-CERT recommends that organizations evaluate the impact of these vulnerabilities based on their operational environment, architecture, and product implementation.

BACKGROUND

OmniMetrix is a US-based company that is headquartered in Buford, Georgia.

The affected web interface, OmniView, is a data management control center that is used to monitor and control backup generators. OmniView is only accessible from OmniMetrix’s web site. According to OmniMetrix, its services are deployed across several sectors including Commercial Facilities and Energy. OmniMetrix estimates that its services are primarily used in the United States with a small number of users in Europe, Asia, and South America.

VULNERABILITY CHARACTERIZATION

VULNERABILITY OVERVIEW

CLEARTEXT TRANSMISSION OF SENSITIVE INFORMATIONa

The OmniView web application transmits credentials with the HTTP protocol, which could be sniffed by an attacker that may result in the compromise of account credentials.

CVE-2016-5786b has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).c

WEAK PASSWORD REQUIREMENTSd

Insufficient password requirements for the OmniView web application may allow an attacker to gain access by brute forcing account passwords.

CVE-2016-5801e has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).f

VULNERABILITY DETAILS

EXPLOITABILITY

These vulnerabilities could be exploited remotely.

EXISTENCE OF EXPLOIT

No known public exploits specifically target these vulnerabilities.

DIFFICULTY

An attacker with low skill would be able to exploit these vulnerabilities.

MITIGATION

OmniMetrix has deployed a new version of OmniView software that resolves the reported vulnerabilities. OmniMetrix reports that it has implemented the use of HTTPS protocol and enforces strong password requirements. When OmniMetrix’s users log into the OmniMetrix web site, they will be prompted to change passwords. OmniMetrix recommends that users log into their accounts as soon as possible to change their passwords:

https://webdata.omnimetrix.net/omxphp/omxLogin.php

For additional information about the new version of OmniView, contact OmniMetrix at:

https://www.omnimetrix.net/en/support/customer-support/

ICS-CERT also provides a section for control systems security recommended practices on the ICS-CERT web page at: http://ics-cert.us-cert.gov/content/recommended-practices. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

Additional mitigation guidance and recommended practices are publicly available in the ICS‑CERT Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies, that is available for download from the ICS-CERT web site (http://ics-cert.us-cert.gov/).

Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to ICS-CERT for tracking and correlation against other incidents.


Contact Information

For any questions related to this report, please contact the NCCIC at:

Email: NCCICCUSTOMERSERVICE@hq.dhs.gov
Toll Free: 1-888-282-0870

For industrial control systems cybersecurity information:  http://ics-cert.us-cert.gov 
or incident reporting:  https://ics-cert.us-cert.gov/Report-Incident?

The NCCIC continuously strives to improve its products and services. You can help by choosing one of the links below to provide feedback about this product.

Was this document helpful?  Yes  |  Somewhat  |  No

Back to Top