Vendor Description
“Automation is our world. Perfect application solutions are our goal.
In 1945, Walter Pepperl and Ludwig Fuchs founded a small radio workshop in Mannheim, Germany, based on the principles of inventiveness, entrepreneurial foresight, and self-reliance. The experience they acquired was transformed into new ideas, and they continued to enjoy developing products for customers. The eventual result was the invention of the proximity switch. This innovation represented the starting point of the company’s success story.
Today, Pepperl+Fuchs is known by customers around the world as a pioneer and an innovator in electrical explosion protection and sensor technology. Our main focus is always on your individual requirements: With a passion for automation and groundbreaking technology, we are committed to working in partnership with you now and in the future. We understand the demands of your markets, developing specific solutions, and integrating them into your processes.”
Source: https://www.pepperl-fuchs.com/usa/en/25.htm
Business Recommendation
SEC Consult recommends to update the devices to the newest firmware (1.3.1), which is available for the following devices:
- ICRL-M-8RJ45/4SFP-G-DIN
- ICRL-M-16RJ45/4CP-G-DIN
According to the vendor, this update only resolves issue 5). The other devices and vulnerabilities can be mitigated by the measures described by Pepperl+Fuchs in their security advisory, see “Workaround”.
Vulnerability Overview / Description
As the vulnerabilities are completely intersecting with the vulnerabilities of the actual OEM, which did not respond at the time of disclosure, some details were removed from “Vulnerability overview/description”.
1) Unauthenticated Device Administration (CVE-2020-12500)
Pepperl+Fuchs Comtrol devices can be managed via a Windows client program called “Jet View”. This program communicates in plaintext via UDP. All messages that are sent to the device are broadcasted in the whole subnet and the answers from the devices are send back via broadcast too.
Actions that can be done via this daemon, listening on UDP port 5010, are:
- Modifying networking settings (IP, netmask, gateway)
- Initiating self tests and blink LEDs on the device
- Triggering download and upload of configuration files (via TFTP)
- Triggering uploads of new firmware and bootloader files (via TFTP)
The device can also be bricked via this daemon so that it is necessary to press the reset button and re-configure the settings. This was tested on a physical device.
2) Backdoor Accounts (CVE-2020-12501)
Multiple different backdoor accounts were found during quick security checks of different firmware files. Some accounts were just read-only users according to the vendor.
3) Cross-Site Request Forgery (CSRF) (CVE-2020-12502)
The web interface that is used to set all configurations is vulnerable to cross-site request forgery attacks. An attacker can change settings by luring the victim to a malicious website.
4) Multiple Authenticated Command Injections (CVE-2020-12503)
Multiple command injection vulnerabilities were found on the RocketLinx devices and devices using the same firmware. Due to the lack of CSRF protection, an attacker can execute arbitrary commands on the device by luring the victim to click on a malicious link.
5) Arbitrary Unauthenticated TFTP Actions (CVE-2020-12504)
A TFTP service is present on a broad range of devices for firmware-, bootloader-, and configuration-uploads/downloads. This TFTP server can be abused to read all files from the system as the daemon runs as root which results in a password hash exposure via the file /etc/passwd. Write access is restricted to certain files (configuration, certificates, boot loader, firmware upgrade) though.
By uploading malicious Quagga config-files an attacker can modify e.g. IP-settings of the device. Malicious firmware and bootloader uploads are possible too.
Proof Of Concept
As the vulnerabilities are completely intersecting with the vulnerabilities of the actual OEM, which did not respond at the time of disclosure, the complete section “Proof of concept” was removed from this advisory.
Vulnerable / Tested Versions
- Comtrol ES7510 <=1.4
- Comtrol ES7510-XT <=2.1b
- Comtrol ES7506 <=2.1b
- Comtrol ES8509-XT <=2.1a
- Comtrol ES8510 <=3.1a
- Comtrol ES8510-XT <=3.1a
- Comtrol ES9528-XTv2 <=2.1a
The following devices are just prone to 3), 4) and 5):
- ICRL-M-8RJ45/4SFP-G-DIN <=1.2.3
- ICRL-M-ICRL-M-16RJ45/4CP-G-DIN <=1.2.3