CVE-2020-25191: 
NI CompactRIO vulnerability analysis and mitigation

A high-severity vulnerability (CVE-2020-25191) was discovered in National Instruments (NI) CompactRIO, a real-time embedded industrial controller. The vulnerability affects driver versions prior to 20.5 and was disclosed in December 2020. The issue stems from incorrect permissions being set by default for an API entry-point of a specific service, which allows non-authenticated users to trigger a function that could reboot the CompactRIO device remotely (CISA Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. It is classified under CWE-732 (Incorrect Permission Assignment for Critical Resource). The vulnerability requires low skill level to exploit and can be triggered remotely. The affected product is primarily deployed in critical manufacturing sectors worldwide (CISA Advisory).

Successful exploitation of this vulnerability could allow an attacker to remotely reboot the device, potentially causing a prolonged denial-of-service (DoS) condition. This could lead to sudden stops in production processes and result in economic losses for affected companies. Security researchers identified approximately 150 internet-exposed devices using the Shodan search engine (SecurityWeek).

The vulnerability can be exploited remotely by unauthenticated users with low skill requirements. No known public exploits specifically targeting this vulnerability have been reported. The vulnerability was initially reported to the vendor in May 2019 and was patched in September 2020 (SecurityWeek).

NI has released a patch and recommends the following mitigation steps: 1) Download and install the NI CompactRIO 20.5 Driver on the host computer, 2) Update the firmware on CompactRIO controllers to v8.5 or higher, 3) Format the target to apply the new safemode default permissions, and 4) Repeat the firmware update and formatting steps for each affected CompactRIO target. Additionally, CISA recommends minimizing network exposure for control system devices and ensuring they are not accessible from the Internet (CISA Advisory).

The vulnerability was discovered by researchers at Titanium Industrial Security and was reported to the Spanish National Institute of Cybersecurity (INCIBE). NI acknowledged the issue and stated they took immediate action to address the vulnerability, confirming they were not aware of any incidents where this potential vulnerability had been exploited (SecurityWeek).