📄 Piciorgros TMO-100 Information Disclosure

PDF advisory: https://rt-solutions.de/piciorgros/Piciorgros_TMO-100_IP-Logger_en.pdf
    
    Classification
    --------------
    
    - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
    
    - CVSS 4.0 Score: 5.3 / Medium
      CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
    
    - CVSS 3.1 Score: 4.3 / Medium
      CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    
    Affected systems
    ----------------
    
    - Piciorgros TMO-100 V3/V4 with software version below 4.20
      (discovered in V3.72)
    
    Summary
    -------
    
    The Piciorgros TMO-100 is a data modem for TETRA radio networks. It has
    an undocumented system log service, which is provided without
    authentication via TCP port 51986 on the LAN interface. This allows an
    attacker with access to the LAN network to view some of the modem's
    operating parameters, e.g. to plan further attacks. Starting with
    software version 4.20, logger access is only enabled for a 15-minute
    time window after a web login, preventing attacks during normal
    operation.
    
    Details
    -------
    
    During a penetration test carried out on behalf of a customer, a
    Piciorgros TMO-100 data modem was part of the test scope. The
    documentation describes the so-called "IPLog" feature for creating
    support requests to the manufacturer. This feature can be accessed with
    the IP Logger software. Under the hood, the software is connecting to
    TCP port 51968 on the LAN interface, where the modem provides the
    current system status and a live log data stream without authentication:
    
    $ telnet 192.168.0.199 51968
    Trying 192.168.0.199...
    Connected to 192.168.0.199.
    Escape character is '^]'.
    
    [FFFF] | 13.02.25 10:43:25 02:37:37.43 | **** Piciorgros TMO-100 V3.72
    (HW-Rev. 3) Build 1819* Release (Apr 7 2021, 10:35:03) - Logging started
    ****
    [FFFE] | 13.02.25 10:43:25 02:37:37.43 | Serial number: ███ Options:
    8001 Set24: 0080 Set25: 0001
    [FFFE] | 13.02.25 10:43:25 02:37:37.43 | TETRA core SW versions:
    Stack:0454, DSP:0456, MMI:F444
    [F020] | 13.02.25 10:43:38 02:37:51.16 | TETRA CREG state change: 1 ->
    99:1:0
    …
    [E000] | 13.02.25 10:44:34 02:38:46.63 | TETRA registration information:
    1:0:0.
    [F020] | 13.02.25 10:44:41 02:38:53.97 | PPP: Is up.
    [E000] | 13.02.25 10:44:41 02:38:53.98 | PPP link is up in try 1. Own
    IP: 10.14.42.31
    …
    
    The log shows the IP address of the modem in the TETRA network, which
    can be used to carry out attacks on other devices in the TETRA data
    network.
    
    Impact
    ------
    
    An attacker with LAN access to a TMO-100 modem can determine the
    hardware and software version used as well as the IP address in the
    TETRA data network and thus use the modem to scan neighboring IP address
    ranges.
    
    Mitigation for operators
    ------------------------
    
    The modems should be updated to software version 4.20 or higher to limit
    the impact.
    
    Recommendations for the manufacturer
    ------------------------------------
    
    Access should be authenticated in the same way as the web interface and,
    if possible, encrypted using TLS. Implementation via web sockets or
    other APIs as part of the web UI could be a viable alternative.
    
    Timeline
    --------
    
    -   2025-02-13 Discovery of the vulnerability
    -   2025-02-27 Notification to the manufacturer
    -   2025-03-06 Confirmation of the vulnerability by the manufacturer
    -   2025-03-11 Release of software version V4.20 by the manufacturer
    -   2025-08-14 Publication of the vulnerability as part of responsible
        disclosure
    
    -- 
    Dr.-Ing. Georg Lukas
    rt-solutions.de GmbH
    Oberländer Ufer 190a
    D-50968 Köln
    
    Zentrale: (+49)221 93724 0
    Web : www.rt-solutions.de
    rt-solutions.de
    experts you can trust.
    
    Sitz der Gesellschaft: Köln
    Eingetragen beim Amtsgericht Köln: HRB 52645
    Geschäftsführer: Prof. Dr. Ralf Schumann, Dr. Stefan Schemmer