{"id":37208,"date":"2022-10-17T16:39:40","date_gmt":"2022-10-17T13:39:40","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=37208"},"modified":"2026-03-28T01:57:24","modified_gmt":"2026-03-27T22:57:24","slug":"kaspersky-ics-cert-reveals-secrets-in-schneider-umas-protocol","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/kaspersky-ics-cert-reveals-secrets-in-schneider-umas-protocol\/","title":{"rendered":"Kaspersky ICS CERT reveals \u201csecrets\u201d in Schneider UMAS protocol"},"content":{"rendered":"\n

Kaspersky ICS CERT investigated on Unified Messaging Application Services (UMAS) by Schneider Electric and the vulnerabilities of this highly popular protocol, which is used in multiple industries \u2013 from manufacturing to elevator control systems. By exploiting described vulnerabilities, attackers could gain access to the whole automation system of an entity. <\/strong><\/p>\n\n\n\n

UMAS (Unified Messaging Application Services) is Schneider Electric\u2019s proprietary protocol used to configure, monitor, collect data and control Schneider Electric industrial controllers. The use of protocol is very widespread among different industries. The issues described by Kaspersky ICS CERT experts refer to unauthorized access to the programmable logic controller (PLC) and ways cybercriminals take to bypass authentication.<\/p>\n\n\n\n

In 2020, the vulnerability,\u00a0CVE-2020-28212<\/a>, was reported,\u00a0which could be\u00a0exploited by a remote unauthorized attacker to gain control of a programmable logic controller (PLC) with the privileges of an operator already authenticated on the controller. To address the vulnerability, Schneider Electric developed a new mechanism, Application Password, which should provide protection against unauthorized access to PLCs and unwanted modifications.<\/p>\n\n\n\n

An analysis conducted by Kaspersky ICS CERT experts has shown that the implementation of the new security mechanism also has flaws. The\u00a0CVE-2021-22779<\/a>\u00a0vulnerability, which was identified in the course of the research, could allow a remote attacker to make changes to the PLC, bypassing authentication.\u00a0<\/p>\n\n\n\n

As the researchers investigated, the main problem was that the authentication data used to \u201creserve\u201d the device for modification was computed entirely on the client side, and the \u201csecret\u201d used could be obtained from PLC without authentication. <\/p>\n\n\n\n

Schneider Electric published\u00a0an advisory<\/a>\u00a0with a remediation addressing the vulnerabilities. Kaspersky ICS CERT in turn recommends to additionally use network monitoring and deep industrial protocol analysis solutions such as\u00a0Kaspersky Industrial CyberSecurity for Networks<\/a>, to monitor and control remote access attempts to PLC devices.<\/p>\n\n\n\n

\u201c<\/em>The threat landscape is constantly evolving, and an organization\u2019s security strategy must constantly evolve as well to meet new challenges. Today, building cyber security system is not an end-state, but a continuous proactive process \u2013 that is proved by the example of the UMAS protocol. We\u2019re grateful that Schneider Electric managed to respond that rapidly to the discovered vulnerabilities and provide its clients with appropriate solution and recommendations. However, our advice to all responsible for security within an enterprise is to implement special solutions,\u201d – <\/em>comments Pavel Nesterov, a security expert at ICS CERT Kaspersky. <\/em><\/p>\n\n\n\n

Learn more about Schneider Electric\u2019s UMAS protocol and its \u201csecrets\u201d\u00a0on ICS CERT<\/a>.<\/p>\n\n\n\n

To keep your ICS computers protected from various threats, Kaspersky experts recommend: <\/strong><\/p>\n\n\n\n