Critical Vulnerability Could Have Allowed Hackers to Disrupt Traffic Lights

A critical vulnerability affecting traffic light controllers made by SWARCO could have been exploited by hackers to disrupt a city’s traffic lights.


SWARCO is an Austria-based company that specializes in traffic management, traffic safety, road marking and other solutions typically found in smart cities. Its products have been deployed in over 70 countries around the world.


Researchers at ProtectEM, a Germany-based company that provides cybersecurity guidance and solutions for industrial and embedded systems, discovered that SWARCO’s CPU LS4000 traffic light controllers are vulnerable to attacks due to an open port designed for debugging.


The flaw, tracked as CVE-2020-12493 with a CVSS score of 10, was reported to the vendor in July 2019 and a patch was provided by SWARCO to customers in April. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and Germany’s VDE CERT recently published advisories for the vulnerability.


Peter Fröhlich, managing director at ProtectEM, told SecurityWeek that the vulnerability was discovered during a security audit conducted for a city in Germany that hired his company to analyze networked traffic systems.


The affected SWARCO controller runs BlackBerry’s QNX real-time operating system and it’s designed to control traffic lights in one intersection. The system had a debug port open, which granted root access over the network without a password, allowing an attacker to remotely shut down or manipulate impacted controllers.


Fröhlich says his company has found no evidence that these types of systems are exposed to the internet — at least not in the case of the city whose network they analyzed. The more likely attack ..

Support the originator by clicking the read the rest link below.