Researcher Discovers Three Vulnerabilities in Energomera Energy Metering Devices

Anton Boyarkin, an expert at Positive Technologies, has identified three vulnerabilities in the SE805M data collection devices manufactured by Energomera. These devices are used to collect data from energy metering equipment and transmit the information to higher-level automated control systems, as well as to manage and monitor the status of automation objects. Exploiting these bugs, potential attackers could have disabled electricity in apartment buildings, offices, or industrial facilities.

Such equipment is commonly used at substations, in distribution panels of industrial enterprises, and in residential and office buildings. More than 3 million of these devices are produced annually by the manufacturer.

According to experts, the majority of potentially vulnerable devices are located in Russia (51%) and Azerbaijan (28%), with smaller numbers found in Belarus (2%), Germany (2%), and Kazakhstan (1%).

“Hundreds of meters can be connected to a single device. By using a vulnerable data collection device as a gateway, an attacker could not only gain access to these meters and disrupt the metering system in that area, but also cut off the power supply,” commented Anton Boyarkin, head of the industrial control systems security group at Positive Technologies.

Details of the Vulnerabilities

• The first vulnerability is classified as critical. Identified as BDU:2023-04841, it received an almost maximum score of 9.8 on the CVSS 3.0 scale and allowed attackers to change device parameters.
• The second vulnerability (BDU:2023-04842) allowed attackers to compromise the integrity of the database or cause a denial of service (scoring 8.1 points).
• The third vulnerability (BDU:2023-04843) enabled an attacker to modify a device parameter in such a way as to insert OS commands, which would be executed during the automatic update of the application software (scoring 8.8 points).

Manufacturer Response and Recommendations

The manufacturer was notified of the issues as part of a responsible disclosure policy and has already released a software update to address the vulnerabilities. Energomera now recommends updating the device firmware to version 4.13. In addition, Positive Technologies specialists advise, where possible, to restrict or block access to the network port used for remote configuration of the data collection devices.