CVSS v3 10.0
ATTENTION: Exploitable remotely/low skill level to exploit
This updated advisory is a follow-up to the advisory update titled ICSA-19-036-05 (Update A) Kunbus PR100088 Modbus Gateway that was published February 7, 2019, on the NCCIC/ICS-CERT website.
Successful exploitation of these vulnerabilities could allow an attacker to achieve remote code execution and/or cause a denial-of-service condition.
The following versions of PR100088 Modbus gateway are affected:
An attacker may be able change the password for an admin user who is currently or previously logged in, provided the device has not been restarted.
Registers used to store Modbus values can be read and written from the web interface without authentication.
An attacker could specially craft an FTP request that could crash the device.
An attacker could retrieve passwords from an HTTP GET request if the attacker is in an MITM position.
An attacker could retrieve plain-text credentials stored in an XML file through FTP.
Nicolas Merle of Applied Risk reported these vulnerabilities to NCCIC. NCCIC coordinated these vulnerabilities with BSI Germany.
Kunbus recommends the following:
--------- Begin Update B Part 1 of 1 ---------
--------- End Update B Part 1 of 1 ---------
NCCIC recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:
NCCIC reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
NCCIC also provides a section for control systems security recommended practices on the ICS-CERT web page. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Additional mitigation guidance and recommended practices are publicly available on the ICS-CERT website in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to NCCIC for tracking and correlation against other incidents.
No known public exploits specifically target these vulnerabilities.
For any questions related to this report, please contact the NCCIC at:
Toll Free: 1-888-282-0870
For industrial control systems cybersecurity information: http://ics-cert.us-cert.gov
or incident reporting: https://ics-cert.us-cert.gov/Report-Incident?
The NCCIC continuously strives to improve its products and services. You can help by choosing one of the links below to provide feedback about this product.
This product is provided subject to this Notification and this Privacy & Use policy.
Was this document helpful? Yes | Somewhat | No