Nicolas Merle from industrial cybersecurity firm Applied Risk discovered several flaws in a gateway produced by the Germany-based firm Kunbus, some of them could allow an attacker to gain full control of the vulnerable devices. Kunbus gateway solutions are used by several organizations worldwide.
Merle discovered five vulnerabilities in the Kunbus PR100088 Modbus gateways running version 1.0.10232 and likely earlier versions.
Applied Risk has classified two vulnerabilities as “critical” and two as “high severity.”
The gateway is affected by an improper authentication issue (CVE-2019-6527) in the Modbus gateway web application that fails to check that the user is logged in when processing the change of password page.
The CVE-2019-6527 flaw could be exploited by attackers to take complete control of the gateway and lock legitimate admins out.
The exploitation is possible only when an admin user logged in previously on the vulnerable gateway and the device has not been restarted since.
Another flaw, tracked as CVE-2019-6533, can be exploited by an unauthenticated attacker to read and modify the registers used to store Modbus values from the web interface. The flaw could be exploited by an attacker to cause a denial-of-service (DoS) condition by rebooting the device.
The researcher also found another DoS issue that could be exploited by sending a long request (more than 256 characters) to the FTP service.
Another issue discovered by the researcher is related to the disclosure of the user password that is included in the HTTP GET request used in the authentication phase. The password is in clear text and an attacker in the MiTM position can obtain it.
Kunbus addressed four of the flaws with the release of version 1.1.13166 (Security Update R02). The remaining flaw affects the FTP service that can be used to retrieve user credentials stored on the device in clear text in an XML file. This latter issue is expected to be fixed at the end of February with the Security Update R03.
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.