Pierluigi Paganini February 08, 2019

Security of Industrial system is a top priority, experts found multiple serious flaws in a gateway made by Kunbus that could allow to completely control a device

Nicolas Merle from industrial cybersecurity firm Applied Risk discovered several flaws in a gateway produced by the Germany-based firm Kunbus, some of them could allow an attacker to gain full control of the vulnerable devices. Kunbus gateway solutions are used by several organizations worldwide.
Merle discovered five vulnerabilities in the Kunbus PR100088 Modbus gateways running version 1.0.10232 and likely earlier versions.

Applied Risk has classified two vulnerabilities as “critical” and two as “high severity.”

“An unauthenticated user can change the admin password, use it to get full control of the device, change its configuration and then lock the administrator out. An authenticated user can send a malicious request to the ftp service, stopping the device until the next cold reboot. An attacker able to sniff the traffic would be able to get any password used for login.” reads the security advisory published by Applied Risk.

“An unauthenticated user can see and change the Modbus register value via the web interface and reboot the device with a simple command, creating a denial of service. Finally, an attacker could change the Administrator password to the default one, to trick the operator to input back its password that he could in return recover via the ftp service.”

The gateway is affected by an improper authentication issue (CVE-2019-6527) in the Modbus gateway web application that fails to check that the user is logged in when processing the change of password page.

The CVE-2019-6527 flaw could be exploited by attackers to take complete control of the gateway and lock legitimate admins out.

The exploitation is possible only when an admin user logged in previously on the vulnerable gateway and the device has not been restarted since.

Another flaw, tracked as CVE-2019-6533, can be exploited by an unauthenticated attacker to read and modify the registers used to store Modbus values from the web interface. The flaw could be exploited by an attacker to cause a denial-of-service (DoS) condition by rebooting the device.

The researcher also found another DoS issue that could be exploited by sending a long request (more than 256 characters) to the FTP service.

Another issue discovered by the researcher is related to the disclosure of the user password that is included in the HTTP GET request used in the authentication phase. The password is in clear text and an attacker in the MiTM position can obtain it.

Kunbus addressed four of the flaws with the release of version 1.1.13166 (Security Update R02). The remaining flaw affects the FTP service that can be used to retrieve user credentials stored on the device in clear text in an XML file. This latter issue is expected to be fixed at the end of February with the Security Update R03.

ICS-CERTand Kunbus also published security advisories describing the flaws.

Pierluigi Paganini

(SecurityAffairs – Kunbus, hacking)

[adrotate banner=”5″] [adrotate banner=”13″]