CVE-2019-13553
📋 TL;DR
This vulnerability allows attackers to bypass authentication on Rittal Chiller SK 3232-Series cooling systems using hard-coded credentials. Attackers can control critical operations like turning the cooling unit on/off and changing temperature settings. Organizations using these industrial control systems for facility cooling are affected.
💻 Affected Systems
- Rittal Chiller SK 3232-Series
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of cooling systems leading to equipment damage, environmental control failure, or disruption of temperature-sensitive operations in data centers, hospitals, or industrial facilities.
Likely Case
Unauthorized access to cooling controls causing temperature fluctuations, increased energy consumption, or temporary service disruption.
If Mitigated
Limited impact if systems are isolated from networks and physical access is controlled, though hard-coded credentials remain a persistent risk.
🎯 Exploit Status
Exploitation requires only knowledge of hard-coded credentials and network access to the web interface. No authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware versions after B1.2.4
Vendor Advisory: https://www.us-cert.gov/ics/advisories/icsa-19-297-01
Restart Required: Yes
Instructions:
1. Contact Rittal or Carel for updated firmware. 2. Backup current configuration. 3. Apply firmware update following vendor instructions. 4. Verify authentication now requires unique credentials. 5. Change default passwords if applicable.
🔧 Temporary Workarounds
Network Segmentation
allIsolate chiller control systems from untrusted networks using firewalls or VLANs
Access Control Lists
allRestrict network access to chiller web interface to authorized management systems only
🧯 If You Can't Patch
- Physically isolate chiller control network from all other networks
- Implement continuous monitoring for unauthorized access attempts to chiller web interface
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface login page or device management interface. If version is A1.5.3 through B1.2.4, system is vulnerable.Check Version:
Access web interface and check firmware/version information page, or use vendor-specific management tools.Verify Fix Applied:
After patching, attempt to authenticate with previously known hard-coded credentials. Access should be denied. Verify firmware version shows post-B1.2.4.📡 Detection & Monitoring
Log Indicators:
- Failed authentication attempts with default credentials
- Successful logins from unexpected IP addresses
- Configuration changes to temperature settings or power state
Network Indicators:
- HTTP requests to chiller web interface from unauthorized sources
- Traffic patterns indicating temperature setting changes
SIEM Query:
source_ip NOT IN (authorized_management_ips) AND dest_port=80 AND (uri_contains="/login" OR uri_contains="/config")