HMS Networks addresses critical security vulnerability in IPm RTU hardware

HMS Networks has issued a security bulletin regarding a critical vulnerability affecting its IPm RTU device lineup, which carries a maximum CVSS v2.0 base score of 10.0. The vulnerability allows remote attackers to execute arbitrary code or modify sensitive files by exploiting undocumented function codes in the Sixnet universal protocol.

Affected units include models such as the ST-IPm-6350 and various iterations of the VT-mIPm and VT-IPm2m series. The flaw is particularly acute when Telnet and FTP services are enabled, as these can facilitate unauthorized root access to the device through Ethernet interfaces.

To remediate these risks, the company recommends specific configuration changes, including disabling root accounts via command-line tools, enforcing user authentication for all services, and deploying custom iptables rules to restrict Sixnet UDR traffic. Security professionals continue to advise that industrial control systems remain isolated from the internet behind firewalls to prevent unauthorized access.