In addition, a Windows Service running under LocalSystem is located within this directory as well. Successful exploitation of this vulnerability could cause loss of availability, integrity, and confidentiality with the local system and a disruption in communications with other connected devices. When the MiCOM S1 application is run, the malicious executable would be run instead. A malicious user with any level of access to the local system could replace executables within the MiCOM S1 Program Files directory with malicious files. The MiCOM S1 Software does not limit user access to its installed executables to only authenticated administrative users. VULNERABILITY CHARACTERIZATION VULNERABILITY OVERVIEW According to Alstom, MiCOM S1 Software is deployed across the energy sector. The affected products, Alstom Grid MiCOM S1 Agile and Studio Software, allows users to configure Alstom Grid’s range of protective relays. BACKGROUNDĪlstom Grid is a global company that maintains offices in several countries around the world, including the US, UK, Canada, Italy, India, Brazil, France, Russia, Saudi Arabia, United Arab Emirates and Singapore. ICS‑CERT recommends that organizations evaluate the impact of this vulnerability based on their operational environment, architecture, and product implementation. Impact to individual organizations depends on many factors that are unique to each organization. This vulnerability can affect products deployed in the energy, dams, healthcare and public health, water, chemical, and commercial facilities. Unauthorized attackers can then access the MiCOM S1 executable files. Successful exploitation of this vulnerability may allow an attacker with read/modify user permissions for the MiCOM S1 file system to affect the availability of the application.

Legacy MiCOM S1 Studio Software, all versions.

MiCOM S1 Agile Software, all versions up to and including v1.0.2, and.

The following Alstom Grid products are affected: Alstom has tested the update to validate that it resolves the vulnerability. Alstom has produced an update that mitigates this vulnerability. This advisory only addresses the Alstom software product.Īlstom has identified an improper authorization vulnerability in the Alstom Grid MiCOM S1 Agile Software. A user could have MiCOM S1 Studio Software from a different vendor. Note: Alstom Grid MiCOM S1 Studio Software is its own software suite. This advisory provides mitigation details for a vulnerability affecting the Alstom Grid MiCOM S1 Agile and S1 Studio Software.

Micom s1 v2 data model