Privilege escalation vulnerability in MICROSENS Profi Line Modular Industrial Switch Web

SEC Consult Vulnerability Lab Security Advisory < 20140228-0 >


title: Privilege escalation vulnerability

product: MICROSENS Profi Line Modular Industrial Switch Web

Manager (MS652119PM)

vulnerable version: Firmware version 10.3.1

fixed version: Firmware version 10.3.2

impact: High


found: 2013-08-21

by: Christian Kudera, Stefan Riegler

SEC Consult Vulnerability Lab



Vendor description:


"The new Profi Line Modular switches, from MICROSENS, offer maximum

performance and flexibility in smallest spaces. Robust, modular, expandable

and designed for greatest reliability and shortest recovery times, the Profi

Line Modular series has become the first-choice solution for Industrial






Business recommendation:


SEC Consult has identified a privilege escalation in the MICROSENS Web Manager

in the course of a very limited infrastructure audit. Very little time was

spent on the affected product.


The Web Manager can be used with read only permission to check the

configuration on the device (e.g. VLANs, Port status). Additionally the Web

Manager can be used with read and write permission to configure the device.


Using the identified vulnerability a low privileged user having read only

permission can elevate his privileges to contain read and write permissions.



Vulnerability overview/description:


The Web Manager contains a login form to authenticate a user. The Web Manager

offers different levels of privilege (e.g. read only permission, read and

write permission, debugging permission).


The login attempt is checked through a CGI binary, but the response of the

binary is validated at the client side via JavaScript. An attacker can

intercept and modify the response of the binary, thus achieving authentication

and the desired level of authorization. No further validation is performed by

the Web Manager.



Proof of concept:


The login generates the following request to the server:



This request triggers a CGI binary, which validates the login attempt and

returns the following response:

      <!-- last change: 17.04.2012 -->
      <!-- returned at uptime of 141056 seconds -->
        <date>2012/05/29 17:28:00</date>
        <par name="cmd" type="STRING" >
        <par name="result" type="UNSIGNED" >
        <par name="lunam" type="STRING" >
        <par name="liid" type="STRING" >
        <par name="rhost" type="STRING" >
        <par name="a_s_b" type="STRING" >


The parameter "result" informs the client about the properness of the provided

login credentials.

The parameter can correspond to the following values:

255 login failed

1 login with read only permission

2 login with read and write permission

3 login with debugging permission


For example, if the value of the parameter "result" is changed to 3, the user

gets logged in with debugging permissions.



Vendor contact timeline:


2013-09-10: Contacting vendor

2013-09-11: Sending advisory and proof of concept exploit via encrypted


2013-09-11: Vendor acknowledges receipt of advisory.

2013-10-18: Vendor responds and wants to release update on 2013-10-31.

2013-10-31: MICROSENS releases fixed version.

2014-02-07: Conference call: Clarifying pending questions regarding the fixed


2014-02-28: SEC Consult releases coordinated security advisory.





Update to the most recent firmware version 10.3.2





All accounts with read only permissions should be disabled on the device.



Advisory URL:





SEC Consult Vulnerability Lab


SEC Consult

Vienna - Bangkok - Frankfurt/Main - Montreal - Singapore - Vilnius



Mooslackengasse 17, 1190 Vienna, Austria

Phone: +43 1 8903043 0

Fax: +43 1 8903043 15


Mail: research at sec-consult dot com





Interested in working with the experts of SEC Consult?

Write to


EOF Christian Kudera / @2014