On September 13, 2022, CISA posted an Industrial Control System Advisory (ICSA-22-256-04) regarding Kingspan TMS300 CS water tank management system – provided in WaterISAC’s CISA ICS Vulnerability Advisories and Alerts, Updates, and Bulletins - September 13, 2022. The vulnerability is considered critical and reportedly impacts all versions of Kingspan TMS300 CS. It can be exploited remotely and requires low complexity to exploit. Specifically, a researcher reports that the product is affected by a critical vulnerability that allows an attacker to access the device to view or modify the device’s settings without authenticating.

According to CISA, Kingspan has not responded to requests to mitigate (patch) the vulnerability. In light of a patch not being available at this time, any utility using the specified system are encouraged to contact Kingspan customer support for additional information, assess the vulnerability against your environment, and apply appropriate compensating controls to protect the vulnerable system. CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:

• Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.
• Locate control system networks and remote devices behind firewalls and isolate them from business networks.
• When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices.

For more information, visit SecurityWeek and CISA’s ICS Advisories.