Auto-Maskin DCU-210E RP-210E up to 3.7 on ARM7 Modbus Communication Messages origin validation

Summaryinfo

A vulnerability, which was classified as critical, has been found in Auto-Maskin DCU-210E RP-210E up to 3.7 on ARM7. The impacted element is an unknown function of the component Modbus Communication Handler. This manipulation as part of Messages causes origin validation. This vulnerability is tracked as CVE-2018-5400. The attack is only possible within the local network. No exploit exists. It is advisable to implement restrictive firewalling.

Detailsinfo

A vulnerability has been found in Auto-Maskin DCU-210E RP-210E up to 3.7 on ARM7 and classified as critical. Affected by this vulnerability is an unknown functionality of the component Modbus Communication Handler. The manipulation as part of a Messages leads to a origin validation vulnerability. The CWE definition for the vulnerability is CWE-346. The product does not properly verify that the source of data or communication is valid. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

The Auto-Maskin products utilize an undocumented custom protocol to set up Modbus communications with other devices without validating those devices. The originating device sends a message in plaintext, 48:65:6c:6c:6f:20:57:6f:72:6c:64, "Hello World" over UDP ports 44444-44446 to the broadcast address for the LAN. Without verification devices respond to any of these broadcast messages on the LAN with a plaintext reply over UDP containing the device model and firmware version. Following this exchange the devices allow Modbus transmissions between the two devices on the standard Modbus port 502 TCP. Impact: An attacker can exploit this vulnerability to send arbitrary messages to any DCU or RP device through spoofing or replay attacks as long as they have access to the network. Affected releases are Auto-Maskin DCU-210E RP-210E: Versions prior to 3.7 on ARMv7.

The bug was discovered 10/06/2018. The weakness was disclosed 10/08/2018 as confirmed advisory (CERT.org). The advisory is shared at kb.cert.org. This vulnerability is known as CVE-2018-5400 since 01/11/2018. The attack can only be done within the local network. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available.

The vulnerability was handled as a non-public zero-day exploit for at least 2 days. During that time the estimated underground price was around $0-$5k.

Proper firewalling of udp 44444-44446 is able to address this issue.

The entries VDB-125076, VDB-125078 and VDB-125079 are pretty similar. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Auto-Maskin

Name

• DCU-210E RP-210E

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion