Quantum Secular Labs / Blog / Advisories

CVE-2018-5400: Auto Maskin Rp 210e Firmware: Origin Validation Error

CVE-2018-5400 is rated critical with a CVSS v3.0 base score of 9.1 and NVD lists 2 affected products, including Auto Maskin Rp 210e Firmware. Per its scoring, it can be exploited over the network, without authentication, without any user interaction.

Vulnerability description

The Auto-Maskin products utilize an undocumented custom protocol to set up Modbus communications with other devices without validating those devices. The originating device sends a message in plaintext, 48:65:6c:6c:6f:20:57:6f:72:6c:64, "Hello World" over UDP ports 44444-44446 to the broadcast address for the LAN. Without verification devices respond to any of these broadcast messages on the LAN with a plaintext reply over UDP containing the device model and firmware version. Following this exchange the devices allow Modbus transmissions between the two devices on the standard Modbus port 502 TCP. Impact: An attacker can exploit this vulnerability to send arbitrary messages to any DCU or RP device through spoofing or replay attacks as long as they have access to the network. Affected releases are Auto-Maskin DCU-210E RP-210E: Versions prior to 3.7 on ARMv7.

Severity breakdown

CVSS v3.0 9.1: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

  • Attack vector: Network. Exploitable remotely over the network, with no need for local or physical access.
  • Attack complexity: Low. No special conditions; the attack can be repeated reliably.
  • Privileges required: None. No account or prior access is needed.
  • User interaction: None. No action from any user is needed.
  • Scope: Unchanged. Impact stays within the vulnerable component.
  • Confidentiality impact: High. Total loss of confidentiality; sensitive data can be fully disclosed.
  • Integrity impact: High. Total loss of integrity; data or system state can be fully modified.
  • Availability impact: None. No effect on availability.

Underlying weakness

CWE-346: Origin Validation Error

The product does not properly verify that the source of data or communication is valid.

Affected products

  • Auto Maskin Rp 210e Firmware: all versions listed by NVD
  • Auto Maskin Dcu 210e Firmware: all versions listed by NVD

References