Labkotec LID-3300IP Ice Detector Vulnerability Allowing Unauthorized Parameter Modification and Command Execution

A vulnerability exists in the Labkotec LID-3300IP ice detector software, allowing an unauthenticated attacker to modify device parameters and execute operational commands by sending specially crafted packets to the device. This issue affects all versions of the Labkotec LID-3300IP, including Type 2.

Impact

Exploitation of this vulnerability could lead to unauthorized control over system operations, disrupting normal functionality and potentially creating safety hazards.

Remediation

CISA recommends minimizing network exposure for all control system devices, ensuring they are not accessible from the internet. Control system networks and remote devices should be located behind firewalls and isolated from business networks. When remote access is necessary, use secure methods such as Virtual Private Networks (VPNs), while keeping in mind that VPNs may have vulnerabilities and should be updated to the latest version. Organizations should perform a proper impact analysis and risk assessment before deploying defensive measures.