Multiple binary application files on the CMS8000 device are compiled with 'not stripped' and 'debug_info' compilation settings. These compiler settings greatly decrease the level of effort for a threat actor to reverse engineer sensitive code and identify additional vulnerabilities.
Workaround:
The product is deployed to unauthorized actors with debugging code still enabled or active, which can create unintended entry points or expose sensitive information.
Link | Tags |
---|---|
https://www.cisa.gov/uscert/ics/advisories/icsma-22-244-01 | us government resource third party advisory mitigation |