Cybersecurity researchers have disclosed details of a new vulnerability in a system used across oil and gas organizations that could be exploited by an attacker to inject and execute arbitrary code.
The high-severity issue, tracked as CVE-2022-0902 (CVSS score: 8.1), is a path-traversal vulnerability in ABB Totalflow flow computers and remote controllers.
“Attackers can exploit this flaw to gain root access on an ABB flow computer, read and write files, and remotely execute code,” industrial security company Claroty said in a report shared with The Hacker News.
ABB, a Swedish-Swiss industrial automation firm, has since released firmware updates as of July 14, 2022, following responsible disclosure.
Flow computers are special-purpose electronic instruments used by petrochemical manufacturers to interpret data from flow meters and calculate and record the volume of substances such as natural gas, crude oils, and other hydrocarbon fluids at a specific point in time.
images from Hacker News