Database/Control plane, storage & DevOps

Delta Controls enteliBUS Manager (eBMGR) V3.40_B-571848, dactetra service: Unauthenticated remote code execution

CVSS 9.8CVE-2019-9569Control plane, storage & DevOpsMcAfee ATR HVACkingcurated

Impact

Unauthenticated remote code execution on a central plant controller. The enteliBUS Manager is the box that sequences chillers, pumps, boilers and air handling for a whole building; the research that produced this bug demonstrated full control over HVAC and, on the same hardware family, over the access-control and life-safety points wired into it. Owning it gives an attacker root-equivalent control over the mechanical plant with no credentials and no user interaction, plus the ability to lie to the supervisory system above it. Against a GPU hall this is the textbook scenario: command the plant off or drive setpoints, and a 40 kW+ rack crosses thermal shutdown in minutes while the BMS graphic still shows normal operation. Because the compromise is code execution rather than a config change, it also persists across reboots and survives the operator's instinctive 'restart the controller' response.

Who can reach it

Unauthenticated network access to the controller's service port on the facility network - no credentials, no interaction. enteliBUS controllers are commonly reachable from anywhere on the building VLAN and, in sites where the controls contractor set up remote support, from the internet through a poorly-placed remote-access appliance.

What to do

Firmware update from Delta Controls, applied through the certified Delta dealer who owns the site - operators generally cannot obtain or apply Delta firmware directly, which is itself the problem. That means a scheduled contractor visit and a plant controller offline during the flash: real cooling risk, real cost, and a window most operators will not take without an incident to justify it. Treat segmentation as the primary control: dedicated VLAN, deny-by-default with an allow-list from the supervisor only, and no path from the internet. Verify by scanning your own facility VLAN for the controller's service port rather than trusting the dealer's assurance.

References

https://nvd.nist.gov/vuln/detail/CVE-2019-9569 https://www.mcafee.com/blogs/other-blogs/mcafee-labs/hvacking-understanding-the-delta-between-security-and-reality/https://www.deltacontrols.com/products/hvac-controls/central-plant-controllers/entelibus

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.