ICSA-20-140-02 Emerson OpenEnterprise

The impact of CVE-2020-10640 is severe, particularly within industrial control system (ICS) environments. Successful exploitation allows an attacker to execute arbitrary code with system privileges, effectively granting them full control over the affected SCADA server. This could lead to disruption of critical industrial processes, data breaches, and even physical damage to equipment. The ability to execute commands with system privileges significantly expands the attacker's potential actions, enabling them to modify configurations, steal sensitive data, and potentially compromise other systems on the network. Given the critical nature of SCADA systems, this vulnerability presents a significant threat to operational technology (OT) security.

Organizations that rely on Emerson OpenEnterprise SCADA Software for critical industrial control processes are at significant risk. This includes sectors such as oil and gas, power generation, water treatment, and manufacturing. Specifically, deployments using older, unpatched versions of the software (≤3.3.4) are particularly vulnerable. Shared hosting environments utilizing OpenEnterprise also present a heightened risk due to the potential for cross-tenant exploitation.

• windows / supply-chain:

Get-Process -Name "OpenEnterprise*" | Select-Object -ExpandProperty CommandLine

• linux / server:

ps aux | grep OpenEnterprise

• generic web:

curl -I http://<target_ip>/communication_service/  # Check for unusual response headers

1. 2020-07-16Discovery

   discovery

2. 2022-02-24Disclosure

   disclosure

3. 2022-02-24Patch

   patch

1. 已保留2020-03-16
2. 发布日期2022-02-24
3. 修改日期2025-04-16
4. EPSS 更新日期2026-04-02

The primary mitigation for CVE-2020-10640 is to upgrade to Emerson OpenEnterprise SCADA Software version 3.3.5 or later. If an immediate upgrade is not feasible due to compatibility concerns or system downtime requirements, consider implementing temporary workarounds. Network segmentation can limit the attacker’s ability to reach the vulnerable service. Review firewall rules to restrict access to the communication service to only authorized sources. Monitor system logs for suspicious activity, particularly attempts to execute commands or access sensitive files. While a WAF may not directly address this RCE, it can help detect and block malicious requests targeting the vulnerable service. After upgrading, verify the fix by attempting to trigger the vulnerability using known attack vectors and confirming that the commands are not executed.