• Home
  • Cyber Crime
  • Cyber warfare
  • APT
  • Data Breach
  • Deep Web
  • Digital ID
  • Hacking
  • Hacktivism
  • Intelligence
  • Internet of Things
  • Laws and regulations
  • Malware
  • Mobile
  • Reports
  • Security
  • Social Networks
  • Terrorism
  • ICS-SCADA
  • POLICIES
  • Contact me
MUST READ

Cisco confirms active exploitation of ISE and ISE-PIC flaws

 | 

SharePoint under fire: new ToolShell attacks target enterprises

 | 

CrushFTP zero-day actively exploited at least since July 18

 | 

Hardcoded credentials found in HPE Aruba Instant On Wi-Fi devices

 | 

MuddyWater deploys new DCHSpy variants amid Iran-Israel conflict

 | 

U.S. CISA urges to immediately patch Microsoft SharePoint flaw adding it to its Known Exploited Vulnerabilities catalog

 | 

Microsoft issues emergency patches for SharePoint zero-days exploited in "ToolShell" attacks

 | 

SharePoint zero-day CVE-2025-53770 actively exploited in the wild

 | 

Singapore warns China-linked group UNC3886 targets its critical infrastructure

 | 

U.S. CISA adds Fortinet FortiWeb flaw to its Known Exploited Vulnerabilities catalog

 | 

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 54

 | 

Security Affairs newsletter Round 533 by Pierluigi Paganini – INTERNATIONAL EDITION

 | 

Radiology Associates of Richmond data breach impacts 1.4 million people

 | 

Fortinet FortiWeb flaw CVE-2025-25257 exploited hours after PoC release

 | 

Authorities released free decryptor for Phobos and 8base ransomware

 | 

Anne Arundel Dermatology data breach impacts 1.9 million people

 | 

LameHug: first AI-Powered malware linked to Russia’s APT28

 | 

5 Features Every AI-Powered SOC Platform Needs in 2025

 | 

Broadcom patches critical VMware flaws exploited at Pwn2Own Berlin 2025

 | 

Stormous Ransomware gang targets North Country HealthCare, claims 600K patient data stolen

 | 
  • Home
  • Cyber Crime
  • Cyber warfare
  • APT
  • Data Breach
  • Deep Web
  • Digital ID
  • Hacking
  • Hacktivism
  • Intelligence
  • Internet of Things
  • Laws and regulations
  • Malware
  • Mobile
  • Reports
  • Security
  • Social Networks
  • Terrorism
  • ICS-SCADA
  • POLICIES
  • Contact me
  • Home
  • Breaking News
  • Hacking
  • Vulnerabilities in Kunbus Industrial Gateway allows to control the devices

Vulnerabilities in Kunbus Industrial Gateway allows to control the devices

Pierluigi Paganini February 08, 2019

Security of Industrial system is a top priority, experts found multiple serious flaws in a gateway made by Kunbus that could allow to completely control a device

Nicolas Merle from industrial cybersecurity firm Applied Risk discovered several flaws in a gateway produced by the Germany-based firm Kunbus, some of them could allow an attacker to gain full control of the vulnerable devices. Kunbus gateway solutions are used by several organizations worldwide.
Merle discovered five vulnerabilities in the Kunbus PR100088 Modbus gateways running version 1.0.10232 and likely earlier versions.

Applied Risk has classified two vulnerabilities as “critical” and two as “high severity.”

“An unauthenticated user can change the admin password, use it to get full control of the device, change its configuration and then lock the administrator out. An authenticated user can send a malicious request to the ftp service, stopping the device until the next cold reboot. An attacker able to sniff the traffic would be able to get any password used for login.” reads the security advisory published by Applied Risk.

“An unauthenticated user can see and change the Modbus register value via the web interface and reboot the device with a simple command, creating a denial of service. Finally, an attacker could change the Administrator password to the default one, to trick the operator to input back its password that he could in return recover via the ftp service.”

The gateway is affected by an improper authentication issue (CVE-2019-6527) in the Modbus gateway web application that fails to check that the user is logged in when processing the change of password page.

The CVE-2019-6527 flaw could be exploited by attackers to take complete control of the gateway and lock legitimate admins out.

The exploitation is possible only when an admin user logged in previously on the vulnerable gateway and the device has not been restarted since.

Another flaw, tracked as CVE-2019-6533, can be exploited by an unauthenticated attacker to read and modify the registers used to store Modbus values from the web interface. The flaw could be exploited by an attacker to cause a denial-of-service (DoS) condition by rebooting the device.

The researcher also found another DoS issue that could be exploited by sending a long request (more than 256 characters) to the FTP service.

Another issue discovered by the researcher is related to the disclosure of the user password that is included in the HTTP GET request used in the authentication phase. The password is in clear text and an attacker in the MiTM position can obtain it.

Kunbus PR100088 Modbus

Kunbus addressed four of the flaws with the release of version 1.1.13166 (Security Update R02). The remaining flaw affects the FTP service that can be used to retrieve user credentials stored on the device in clear text in an XML file. This latter issue is expected to be fixed at the end of February with the Security Update R03.

ICS-CERTand Kunbus also published security advisories describing the flaws.

[adrotate banner=”9″] [adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – Kunbus, hacking)

[adrotate banner=”5″] [adrotate banner=”13″]



facebook linkedin twitter

Hacking industral gateway Kunbus Pierluigi Paganini Security Affairs

you might also like

Pierluigi Paganini July 22, 2025
Cisco confirms active exploitation of ISE and ISE-PIC flaws
Read more
Pierluigi Paganini July 22, 2025
SharePoint under fire: new ToolShell attacks target enterprises
Read more

leave a comment

newsletter

Subscribe to my email list and stay
up-to-date!

    recent articles

    Cisco confirms active exploitation of ISE and ISE-PIC flaws

    Hacking / July 22, 2025

    SharePoint under fire: new ToolShell attacks target enterprises

    Hacking / July 22, 2025

    CrushFTP zero-day actively exploited at least since July 18

    Hacking / July 22, 2025

    Hardcoded credentials found in HPE Aruba Instant On Wi-Fi devices

    Security / July 22, 2025

    MuddyWater deploys new DCHSpy variants amid Iran-Israel conflict

    APT / July 21, 2025

    To contact me write an email to:

    Pierluigi Paganini :
    pierluigi.paganini@securityaffairs.co

    LEARN MORE

    QUICK LINKS

    • Home
    • Cyber Crime
    • Cyber warfare
    • APT
    • Data Breach
    • Deep Web
    • Digital ID
    • Hacking
    • Hacktivism
    • Intelligence
    • Internet of Things
    • Laws and regulations
    • Malware
    • Mobile
    • Reports
    • Security
    • Social Networks
    • Terrorism
    • ICS-SCADA
    • POLICIES
    • Contact me

    Copyright@securityaffairs 2024

    We use cookies on our website to give you the most relevant experience by remembering your preferences and repeat visits. By clicking “Accept All”, you consent to the use of ALL the cookies. However, you may visit "Cookie Settings" to provide a controlled consent.
    Cookie SettingsAccept All
    Manage consent

    Privacy Overview

    This website uses cookies to improve your experience while you navigate through the website. Out of these cookies, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities...
    Necessary
    Always Enabled
    Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
    Non-necessary
    Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.
    SAVE & ACCEPT