Published vulnerabilities in maritime equipment

Tracking the vulnerabilities of the information systems to protect is part of the job of a CISO (Chief Information Security Officer). In the maritime ecosystem (port, shipowner, shipyard), the CISO tracks the official vulnerabilities of those systems, the CVEs (Common Vulnerabilities and Exposures), in order to know them and reduce them. A shipowner tracks IT (Information Technology) and OT (Operational Technology), including systems specific to shipping. Only the CISO knows the estate well enough to say whether to monitor Hirschmann, Moxa or both.

The complete inventory of the IT estate falls under configuration management of the information system: vendors to track, versions, systems, geographic sites. It points out every vulnerable item to anyone who reads it. Entering it into a third-party online service hands all of it to an outside company. I advise against it on principle, unless you fully trust that third party.

Fortunately, there are tools whose code is public and that can be self-hosted. In OpenCVE, one declares the vendors and products of one’s estate, arranged by project, and the tool sends an email when a CVE affects one of them, with filters on severity and on known exploitation. Each CVE can be assigned to someone, and the team follows its handling through to the fix. It installs on one’s own servers. Vulnerability-Lookup, developed by CIRCL (Computer Incident Response Center Luxembourg), shows what is known about a CVE: it correlates more than 100 sources, including the NVD (National Vulnerability Database) and vendor advisories, and says from users’ sightings whether the flaw is exploited or patched. An API (Application Programming Interface) allows querying it from one’s own tools. CIRCL runs a public instance, where a CISO who declares a watchlist entrusts the estate to CIRCL. Contributing to one of them is worth more than building yet another tool. For tracking an estate, OpenCVE installed on one’s own infrastructure is today one of the best solutions: the inventory stays in-house.

In the coming years, the CVEs to track will multiply. The maritime cyber community is getting stronger and artificial intelligence is being used to discover vulnerabilities, while few OT hardware and software products have yet been examined by a cybersecurity specialist. Fixes will be harder, because OT equipment stays in service for decades and every change requires a new certification. Ships will therefore sail with vulnerable equipment.

The risk of a CVE depends on the attack path to the equipment, and version 4 of the CVSS score (Common Vulnerability Scoring System) takes that exposure into account. A CISO can therefore sleep reasonably well with many CVEs on their systems, as long as none is exploitable from their network. Most CVEs have gone through responsible disclosure, and the vendor concerned has published a fix. That fix must still be applicable to the equipment, then actually applied, which a CISO often cannot do. For each CVE, the CISO checks the state of the fix and the version installed in one’s own estate.

This list covers the 118 CVEs published in the NVD that affect maritime equipment, the oldest on February 4, 2010.

It can be downloaded as CSV and JSON.

The techniques recorded in incidents are in the technique matrix.

Vendors

These 118 CVEs are spread across 21 maritime equipment vendors. CVEs published without a vendor name, or for open-source libraries, are listed at the end of the table.

All CVEs