CVE-2020-12046: 
Opto 22 SoftPAC vulnerability analysis and mitigation

The vulnerability (CVE-2020-12046) affects Opto 22 SoftPAC Project Version 9.6 and prior versions. The vulnerability is related to improper verification of cryptographic signatures during firmware updates, which was discovered and disclosed in May 2020. This security flaw affects the virtual PLC software used in various critical infrastructure sectors including Commercial Facilities, Critical Manufacturing, Information Technology, and Transportation Systems (ICS-CERT Advisory).

The vulnerability is classified as an Improper Verification of Cryptographic Signature (CWE-347) issue. SoftPAC's firmware files' signatures are not verified upon firmware update, creating a security weakness. The vulnerability has been assigned a CVSS v3.1 base score of 5.7 (Medium), with the vector string AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N. This indicates that the vulnerability is network exploitable, requires low attack complexity, needs low privileges, and requires user interaction (ICS-CERT Advisory).

Successful exploitation of this vulnerability allows an attacker to replace legitimate firmware files with malicious files during the update process. This could potentially lead to unauthorized control over the system and compromise of industrial control operations (ICS-CERT Advisory).

The vulnerability requires network access and low privileges for exploitation. It also requires user interaction, suggesting that social engineering or other user-dependent methods might be necessary for successful exploitation. No known public exploits specifically targeting this vulnerability have been reported (ICS-CERT Advisory).

Opto 22 has released PAC Project 10.3 to address this vulnerability. Users are advised to upgrade to this version. Additionally, CISA recommends implementing defensive measures including monitoring or restricting Port 22000 at the firewall, minimizing network exposure for control system devices, and ensuring systems are not accessible from the Internet. When remote access is required, secure methods such as VPNs should be used (ICS-CERT Advisory).