HMS Networks PEAK-System Windows Drivers Multiple Vulnerabilities

HMS Networks has identified multiple critical security vulnerabilities affecting the PEAK-System Device Driver Setup (versions 5.1.2.1151 and earlier) and PCAN Windows CAN device drivers (versions 5.1.2 and earlier). These vulnerabilities, including out-of-bounds write (CWE-787), buffer overflow (CWE-120), and improper pointer dereferencing, arise from flaws in input handling, length parameter validation, and array indexing within the driver IOCTL and write paths. An attacker with local access to a system running these drivers can exploit these flaws by sending specifically crafted input to the driver, resulting in a denial-of-service condition via a Windows kernel crash. This represents a significant risk for systems integrated within critical infrastructure sectors, including energy, transportation, and manufacturing, where the stability of CAN bus communications is paramount.

Impact

Successful exploitation of these vulnerabilities leads to a Windows kernel crash, resulting in a denial-of-service for the affected host and the associated industrial control system process. These drivers are globally deployed in critical sectors such as Transportation, Healthcare, Energy, and Critical Manufacturing. If the driver is hosting a critical control process, a crash could lead to a temporary loss of industrial process visibility or control.

Recommendation

1. Upgrade all instances of the PEAK-System Device Driver Setup and PCAN Windows CAN device drivers to version 5.1.4 or later immediately.
2. Audit systems in critical infrastructure environments for the presence of PEAK-System drivers to determine exposure, focusing on hosts connected to CAN bus interfaces.
3. Restrict local access to systems with these drivers installed to prevent unauthorized users from interacting with the vulnerable driver IOCTL paths.
4. Monitor system event logs for unexpected kernel-mode crashes or bug checks that correlate with software using the PEAK-System interface.