A vulnerability in industrial routers manufactured by Milesight, a Chinese IoT and video surveillance product maker, has recently come to light. Exploit and vulnerability intelligence firm, VulnCheck, has reported the possibility of the vulnerability being exploited in attacks. This raises concerns about the security of critical infrastructure systems that rely on these routers.
Overview of the vulnerability
The vulnerability, known as CVE-2023-43261, affects several UR-series industrial cellular routers from Milesight, mainly Ursalink models. This vulnerability exposes system log files, including the ‘httpd.log’ file, putting the devices at risk.
Implications of the exposed logs
The system log files contain sensitive information, most notably passwords for administrators and other users. This presents a significant risk as remote, unauthenticated attackers can exploit this vulnerability to gain unauthorized access to the targeted devices. Although the passwords are not stored in plain text in the log files, they can be easily cracked, thus compromising the security of the affected systems.
Disclosure and PoC exploit
Security researcher Bipin Jitiya recently disclosed the details of the vulnerability, shedding light on the potential risks involved. Jitiya also released a proof-of-concept (PoC) exploit, which serves as a demonstration of how attackers can take advantage of this vulnerability.
Patching the vulnerability
An analysis conducted by VulnCheck on various firmware versions suggests that CVE-2023-43261 has likely been patched for years. Keeping firmware versions up to date is crucial to ensure the security of industrial routers and protect against potential exploits.
Scope of affected devices
Approximately 5,500 internet-exposed Milesight devices were identified using search engines like Shodan and Censys. However, only a small percentage, around 6.5% (less than 400 devices), appear to be running vulnerable firmware versions. This indicates that the majority of the devices may have already been patched, reducing their vulnerability to attacks.
Instances of Exploitation
Although the number of vulnerable devices seems relatively low, VulnCheck has observed what appears to be small-scale exploitation of this vulnerability. The attackers have been targeting specific systems in France, Lithuania, and Norway, attempting to log into six different systems. These attacks highlight the urgent need for remediation and heightened security measures.
Impact on ICS networks
Alarmingly, some victims had configured VPN servers, providing an entry point for the attacker. By exposing clear text credentials, the attacker can pivot into the Industrial Control Systems (ICS) network, potentially causing severe consequences. This emphasizes the importance of securing not only the routers but also the networks they connect to.
Usage of UR-series routers
Milesight’s UR-series routers find applications in various fields, including industrial automation, self-service kiosks, traffic lighting, smart grid assets, medical equipment, and retail. These critical infrastructure systems rely on the routers for uninterrupted operations, making the security of these devices of paramount importance.
The vulnerability in Milesight industrial routers raises serious concerns about the security of critical infrastructure systems. The exposure of system log files containing passwords provides unauthorized access to malicious actors, compromising the integrity of industrial processes. While the vendor claims to have patched most devices, it is imperative that users keep their firmware up to date and implement proactive security measures. Safeguarding these devices directly contributes to the protection of essential services and ensures the resilience of our critical infrastructure in an increasingly connected world.