ID

VAR-201407-0540

CVE

CVE-2014-2717

TITLE

Honeywell FALCON XLWeb Controllers Authentication Bypass Vulnerability

DESCRIPTION

Honeywell FALCON XLWeb Linux controller devices 2.04.01 and earlier and FALCON XLWeb XLWebExe controller devices 2.02.11 and earlier allow remote attackers to bypass authentication and obtain administrative access by visiting the change-password page. Supplementary information : CWE Vulnerability type by CWE-552: Files or Directories Accessible to External Parties ( Externally accessible file or directory ) Has been identified. http://cwe.mitre.org/data/definitions/552.htmlIf a third party accesses the password change page, authentication may be bypassed and administrative access may be obtained. Honeywell is a manufacturing company focused on automation control. An attacker could exploit this vulnerability to bypass the authentication mechanism and perform unauthorized actions. This may aid in further attacks. Vulnerabilities --------------- CVSS 10 - INSECURE CREDENTIAL STORAGE (Pass the Hash) CVE-2015-7914 CVSS 10 - INSECURE TRANSMISSION OF CREDENTIALS CVE-2015-7915 CVSS 7.4 - CROSS-SITE SCRIPTING CVE-2015-7916 Other risk exposures --------------- Undocumented default accounts Note that default accounts with changeable passwords, even when those are undocumented and do not look as user accounts neither in interface or documentation, constitute a formal vulnerability. It is at worst a misconfiguration. References (Source) --------------- This advisory: https://www.outpost24.com/critical-scada-vulnerabilities-sauter-moduweb/ ICS CERT: https://ics-cert.us-cert.gov/advisories/ICSA-16-033-01 Summary of the issues --------------- In short \x96 By obtaining access to a system using undocumented accounts, it is possible to obtain a low privilege level. By exploiting the fact that the cashed credentials used for the \x93remember me\x94 function of the web application employ the same encryption as the one used for protection of passwords included in backups, a user can elevate privileges to administrator level. The backups also contain other encrypted configuration information which can further an attacker\x92s access to also affect for example email accounts used for notifications. By accessing the system as an administrator, an attacker can obtain those credentials in plain text from the system as they are included in the configuration details, protected only by the use of \x93password\x94 field-types in the forms. In essence this constitute a pass the hash vulnerability. Just as with https://www.outpost24.com/cve-2014-2717-attacking-the-honeywell-falcon-xlweb/ which used hashed inputs to generate secure transfer of credentials over non encrypted connections, applying the same protection scheme to its stored, and exposed, secrets. Don\x92t do your own cryptography. A bit more details, sufficient for the interested reader to recreate but not a straight forward guide, available at the provided references. Martin Jartelius \x96 CSO \x96 Outpost24 John Stock \x96 Technology Program Director \x96 Outpost24 . After giving the market two extra months for patching and also contacting some of the affected national CERTs Outpost24 today released the vulnerability details for CVE-2014-2717. This vulnerability consists of a missing access restriction in combination with a flawed login function, resulting in something as exotic as a pass the hash vulnerability to authenticate with a SCADA system, giving administrative access.* *TL;DR; The Honeywell Falcon (XLWeb Linux/Webserver) contains a vulnerability which allows anyone, even without knowing the username or password, to log in as an administrator in the system. Although information regarding the presence of the vulnerability has been available for a few months since its open disclosure by the ISC CERT to member organizations, there are multiple unpatched systems that remain exposed to the Internet. Outpost24 have waited for an airport we were aware of were affected to patch before releasing. The more full information is available here; http://www.outpost24.com/cve-2014-2717-attacking-the-honeywell-falcon-xlweb/ References: https://ics-cert.us-cert.gov/advisories/ICSA-14-175-01 CVE-2014-2717 AFFECTED PRODUCTS The following Honeywell FALCON XLWeb controller versions are affected: * FALCON Linux 2.04.01 or older * FALCON XLWebExe 2.02.11 or older. The impact to individual organizations depends on many factors that are unique to each organization. ICS-CERT recommends that organizations evaluate the impact of this vulnerability based on their operational environment, architecture and product implementation. The affected products, FALCON XLWeb controllers, are web-based SCADA systems. According to Honeywell, FALCON XLWeb controllers are deployed across several industries including critical manufacturing, energy and wastewater systems among others. According to Honeywell, the affected controllers are used by customers primarily in Europe and the Middle East. Outpost24 would like to direct a thank you to Honeywell and ICS CERT for their fast work in resolving the problems, and we also completely share the vendors recommendation that SCADA systems already in the first place should not be internet facing. The vendor have been a pleasure to work with and have taken every care to resolve the issue timely. Martin Jartelius CSO Outpost24 www.outpost24.com

IOT TAXONOMY

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

Design Error

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Martin Jartelius of Outpost24

SOURCES

LAST UPDATE DATE

2025-04-12T23:04:22.972000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE