Sealevel Systems, Inc. SeaConnect 370W Web Server information disclosure vulnerability

Summary

An information disclosure vulnerability exists in the Web Server functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted man-in-the-middle attack can lead to a disclosure of sensitive information. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.

Tested Versions

Sealevel Systems, Inc. SeaConnect 370W v1.3.34

Product URLs

SeaConnect 370W - <https://www.sealevel.com/product/370w-a-wifi-to-form-c-relays-digital-inputs-a-d-inputs-and-1-wire-bus-seaconnect-multifunction-io-edge-module-powered-by-seacloud/&gt;

CVSSv3 Score

7.4 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-311 - Missing Encryption of Sensitive Data

Details

The SeaConnect 370W is a Wi-Fi connected IIoT device offering programmable cloud access and control of digital and analog I/O and a 1-wire bus.

This device offers remote control via several means including MQTT, Modbus TCP and a manufacturer-specific protocol named “SeaMAX API”.

The device is built on top of the TI CC3200 MCU with built-in Wi-Fi capabilities.

The SeaConnect 370W is host to a web server which enables an authenticated user to view and edit various device configurations, such as analog and digital input and output states, wireless network profiles and device events. In order to access any of the features of the web server, a user must supply a valid username and password. The username and password are provided using the HTTP Basic Auth method, meaning the username and password are sent as a Base64 encoded value in the Authentication header field. This device does not support the use of TLS when interacting with the web server, so an attacker capable of sniffing network traffic between a user and the device could easily extract sensitive information from the HTTP stream.

At the time of this research, the web server was hosted through the TI ‘SimpleLink’ SDK, which TI notes in their documentation does not support HTTPS.

Timeline

2021-10-26 - Vendor disclosure
2022-02-01 - Public Release