Nicolas Merle from industrial cybersecurity firm Applied Risk discovered several flaws in a gateway produced by the Germany-based firm Kunbus, some of them could allow an attacker to gain full control of the vulnerable devices. Kunbus gateway solutions are used by several organizations worldwide.
Merle discovered five vulnerabilities in the Kunbus PR100088 Modbus gateways running version 1.0.10232 and likely earlier versions.
Applied Risk has classified two vulnerabilities as “critical” and two as “high severity.”
The gateway is affected by an improper authentication issue (CVE-2019-6527) in the Modbus gateway web application that fails to check that the user is logged in when processing the change of password page.
The CVE-2019-6527 flaw could be exploited by attackers to take complete control of the gateway and lock legitimate admins out.
The exploitation is possible only when an admin user logged in previously on the vulnerable gateway and the device has not been restarted since.
Another flaw, tracked as CVE-2019-6533, can be exploited by an unauthenticated attacker to read and modify the registers used to store Modbus values from the web interface. The flaw could be exploited by an attacker to cause a denial-of-service (DoS) condition by rebooting the device.
The researcher also found another DoS issue that could be exploited by sending a long request (more than 256 characters) to the FTP service.
Another issue discovered by the researcher is related to the disclosure of the user password that is included in the HTTP GET request used in the authentication phase. The password is in clear text and an attacker in the MiTM position can obtain it.
Kunbus addressed four of the flaws with the release of version 1.1.13166 (Security Update R02). The remaining flaw affects the FTP service that can be used to retrieve user credentials stored on the device in clear text in an XML file. This latter issue is expected to be fixed at the end of February with the Security Update R03.