Vulnerabilities in industrial cellular routers’ cloud management platforms

Issue 2/3 2023 Industrial (Industry), Information Security, Security Services & Risk Management, IoT & Automation

OTORIO, a provider of operational technology (OT) cyber and digital risk management solutions, announced that three significant industrial cellular router vendors have vulnerabilities in their cloud management platforms that expose customers’ operational networks to external attack. This raises questions about the safety of connecting OT to the cloud and suggests a need for standard industry regulations to eliminate such security risks.

An industrial cellular router allows multiple devices to connect to the internet from a cellular network. It is commonly used in industrial settings, such as manufacturing plants or oil rigs, where traditional wired internet connections may not be available or reliable. Vendors of these devices employ cloud platforms to provide customers with remote management, scalability, analytics and security.

However, OTORIO’s research found 11 vulnerabilities in the cloud platforms studied, allowing remote code execution and full control over hundreds of thousands of devices and OT networks – in some cases, even those not actively configured to use the cloud.

OTORIO Security Researcher, Roni Gavrilov, shared key findings and remediation tips at Black Hat Asia 2023 (a white paper on the topic is available here).

“As the deployment of IIoT devices becomes more popular, it's important to be aware that their cloud management platforms may be targeted by threat actors,” said Gavrilov. “A single IIoT vendor platform being exploited could act as a pivot point for attackers, accessing thousands of environments at once.”

OTORIO discovered a wide range of attack vectors based on the security level of the vendor's cloud platform, including several vulnerabilities in M2M (machine-to-machine) protocols and weak asset registration mechanisms. In some cases, these security gaps enable attackers to:

• Gain root access through a reverse-shell.

• Compromise devices in the production network, facilitating unauthorised access and control with root privileges.

• Compromise devices, exfiltrate sensitive information, and perform operations such as shutdown.

Some attacks require identifiers like Media Access Control (MAC) address, serial number or International Mobile Equipment Identity (IMEI) to breach cloud-connected devices, but others do not. One serious issue affecting all three vendors is that their platforms expose devices that have not been configured to use the cloud. Furthermore, breaches of these devices may bypass all the security layers in the Purdue Enterprise Reference Architecture Model for several different vendors.

Find out more at

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

SMART Estate Security returns to KZN
Nemtek Electric Fencing Products Technews Publishing Axis Communications SA OneSpace Editor's Choice News & Events Integrated Solutions IoT & Automation
The second SMART Estate Security Conference of 2024 was held in May in KwaZulu-Natal at the Mount Edgecombe Estate Conference Centre, which is located on the Estate’s pristine golf course.

Using KPIs to measure smart city progress
Axis Communications SA Residential Estate (Industry) Integrated Solutions Security Services & Risk Management
United 4 Smart Sustainable Cities is a United Nations Initiative that encourages the use of information and communication technology (including security technology) to support a smooth transition to smart cities.

Enhancing estate security, the five-layer approach
Fang Fences & Guards Residential Estate (Industry) Integrated Solutions Security Services & Risk Management
Residential estates are designed to provide a serene and secure living environment enclosed within gated communities, offering residents peace of mind and an elevated standard of living.

AI and ransomware: cutting through the hype
AI & Data Analytics Information Security
It might be the great paradox of 2024: artificial intelligence (AI). Everyone is bored of hearing it, but we cannot stop talking about it. It is not going away, so we had better get used to it.

Local manufacturing is still on the rise
Hissco Editor's Choice News & Events Security Services & Risk Management
HISSCO International, Africa's largest manufacturer of security X-ray products, has recently secured a multi-continental contract to supply over 55 baggage X-ray screening systems in 10 countries.

NEC XON shares lessons learned from ransomware attacks
NEC XON Editor's Choice Information Security
NEC XON has handled many ransomware attacks. We've distilled key insights and listed them in this article to better equip companies and individuals for scenarios like this, which many will say are an inevitable reality in today’s environment.

Detecting humans within vehicles without opening the doors
Flow Systems News & Events Security Services & Risk Management
Flow Systems has introduced its new product, which detects humans trying to hide within a vehicle, truck, or container. Vehicles will be searched once they have stopped before one of Flow Systems' access control boom barriers.

Smart mining operations management
Mining (Industry) Infrastructure IoT & Automation
In his presentation at the recent MESA Africa conference, Neels van der Walt, Business Development Manager at Iritron, revealed the all-encompassing concept of SMOM (Smart Mining Operations Management) and why it is inextricably linked to the future of worldwide mining operations.

Cybercriminals embracing AI
Information Security Security Services & Risk Management
Organisations of all sizes are exploring how artificial intelligence (AI) and generative AI, in particular, can benefit their businesses. While they are still figuring out how best to use AI, cybercriminals have fully embraced it.

Perspectives on personal care monitoring and smart surveillance
Leaderware Editor's Choice Surveillance Smart Home Automation IoT & Automation
Dr Craig Donald believes smart surveillance offers a range of options for monitoring loved ones, but making the right choice is not always as simple as selecting the latest technology.