Multiple vulnerabilities in CIRCUTOR products
- CIRCUTOR Q-SMT 1.0.4: firmware version 1.0.4.
- CIRCUTOR TCP2RS+: firmware version 1.3b.
INCIBE has coordinated the publication of 6 vulnerabilities: 3 of critical severity, 1 high and 2 medium, affecting CIRCUTOR's Q-SMT and TCP2RS+ equipment: a device for monitoring the consumption of electrical substations and a gateway oriented to the conversion of the Ethernet physical medium to RS232 or RS485.
The vulnerabilities have been discovered by S21sec's industrial cybersecurity team, special mention to Aarón Flecha, Gabriel Vía Echezarreta (CVE-2024-8887, CVE-2024-8888, CVE-2024-8890 and CVE-2024-8891), Javier Fernandez Beré (CVE-2024-8889 and CVE-2024-8892) and Víctor Bello Cuevas (CVE-2024-8889 and CVE-2024-8892).
These vulnerabilities have been assigned the following codes, CVSS v3.1 base score, CVSS vector and CWE vulnerability type for each vulnerability:
- CVE-2024-8887: 10 | CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | CWE-284.
- CVE-2024-8888: 10 | CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | CWE-613.
- CVE-2024-8889: 9.3 | CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H | CWE-20.
- CVE-2024-8890: 8.0 | CVSS:3.1 AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | CWE-201.
- CVE-2024-8891: 5.3 | CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | CWE-359.
- CVE-2024-8892: 5.3 | CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | CWE-400.
CIRCUTOR Q-SMT, in its firmware version 1.0.5, effectively solved the potential threat. CIRCUTOR made the new version available to its customers privately and strongly recommends them to keep their equipment updated.
As for the CIRCUTOR TCP2RS+ device firmware version 1.3.b (2017), it presents 2 security vulnerabilities exploitable mainly in public communication networks, especially in networks not adequately protected. CIRCUTOR strongly recommends replacing the TCP2RS+ device with the current Line-TCPRS1, both in private and public network environments.
- CVE-2024-8887: CIRCUTOR Q-SMT in its firmware version 1.0.4, could be affected by a denial of service (DoS) attack if an attacker with access to the web service bypasses the authentication mechanisms on the login page, allowing the attacker to use all the functionalities implemented at web level that allow interacting with the device.
- CVE-2024-8888: an attacker with access to the network where CIRCUTOR Q-SMT is located in its firmware version 1.0.4, could steal the tokens used on the web, since these have no expiration date to access the web application without restrictions. Token theft can originate from different methods such as network captures, locally stored web information, etc.
- CVE-2024-8889: vulnerability in CIRCUTOR TCP2RS+ firmware version 1.3b, which could allow an attacker to modify any configuration value, even if the device has the user/password authentication option enabled, without authentication by sending packets through the UDP protocol and port 2000, deconfiguring the device and thus disabling its use. This equipment is at the end of its useful life cycle.
- CVE-2024-8890: an attacker with access to the network where the CIRCUTOR Q-SMT is located in its firmware version 1.0.4, could obtain legitimate credentials or steal sessions due to the fact that the device only implements the HTTP protocol. This fact prevents a secure communication channel from being established.
- CVE-2024-8891: an attacker with no knowledge of the current users in the web application, could build a dictionary of potential users and check the server responses as it indicates whether or not the user is present in CIRCUTOR Q-SMT in its firmware version 1.0.4.
- CVE-2024-8892: vulnerability in CIRCUTOR TCP2RS+ firmware version 1.3b, which could allow an attacker to modify any configuration value, even if the device has the user/password authentication option enabled, without authentication by sending packets through the UDP protocol and port 2000, deconfiguring the device and thus disabling its use. This equipment is at the end of its useful life cycle.
