ID

VAR-201602-0087

CVE

CVE-2015-7915

TITLE

Sauter moduWeb Vision Security Bypass Vulnerability

DESCRIPTION

Sauter EY-WS505F0x0 moduWeb Vision before 1.6.0 sends cleartext credentials, which allows remote attackers to obtain sensitive information by sniffing the network. Sauter moduWeb Vision is an embedded web-based SCADA system for HVAC. A remote attacker could exploit the vulnerability to obtain a certificate and bypass authentication. Sauter moduWeb Vision is prone to multiple security vulnerabilities: 1. Multiple information-disclosure vulnerabilities 2. A cross-site scripting vulnerability An attacker may leverage these issues to obtain potentially sensitive information, steal cookie based authentication credentials and to execute arbitrary HTML and script in the browser of an unsuspecting user in the context of the affected site. Other attacks may also be possible. Vulnerabilities --------------- CVSS 10 - INSECURE CREDENTIAL STORAGE (Pass the Hash) CVE-2015-7914 CVSS 10 - INSECURE TRANSMISSION OF CREDENTIALS CVE-2015-7915 CVSS 7.4 - CROSS-SITE SCRIPTING CVE-2015-7916 Other risk exposures --------------- Undocumented default accounts Note that default accounts with changeable passwords, even when those are undocumented and do not look as user accounts neither in interface or documentation, constitute a formal vulnerability. It is at worst a misconfiguration. References (Source) --------------- This advisory: https://www.outpost24.com/critical-scada-vulnerabilities-sauter-moduweb/ ICS CERT: https://ics-cert.us-cert.gov/advisories/ICSA-16-033-01 Summary of the issues --------------- In short \x96 By obtaining access to a system using undocumented accounts, it is possible to obtain a low privilege level. By exploiting the fact that the cashed credentials used for the \x93remember me\x94 function of the web application employ the same encryption as the one used for protection of passwords included in backups, a user can elevate privileges to administrator level. The backups also contain other encrypted configuration information which can further an attacker\x92s access to also affect for example email accounts used for notifications. By accessing the system as an administrator, an attacker can obtain those credentials in plain text from the system as they are included in the configuration details, protected only by the use of \x93password\x94 field-types in the forms. In essence this constitute a pass the hash vulnerability. Just as with https://www.outpost24.com/cve-2014-2717-attacking-the-honeywell-falcon-xlweb/ which used hashed inputs to generate secure transfer of credentials over non encrypted connections, applying the same protection scheme to its stored, and exposed, secrets. Don\x92t do your own cryptography. A bit more details, sufficient for the interested reader to recreate but not a straight forward guide, available at the provided references. Martin Jartelius \x96 CSO \x96 Outpost24 John Stock \x96 Technology Program Director \x96 Outpost24

IOT TAXONOMY

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

information disclosure

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Martin Jartelius and John Stock of Outpost24.

SOURCES

LAST UPDATE DATE

2025-04-13T23:03:16.549000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE