CVE-2018-5400

The Auto-Maskin DCU 210E, RP-210E, and Marine Pro Observer Android App utilize an undocumented custom protocol to set up Modbus communications with other devices without validating those devices, resulting in an origin validation error

Severity Score

9.1

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The Auto-Maskin products utilize an undocumented custom protocol to set up Modbus communications with other devices without validating those devices. The originating device sends a message in plaintext, 48:65:6c:6c:6f:20:57:6f:72:6c:64, "Hello World" over UDP ports 44444-44446 to the broadcast address for the LAN. Without verification devices respond to any of these broadcast messages on the LAN with a plaintext reply over UDP containing the device model and firmware version. Following this exchange the devices allow Modbus transmissions between the two devices on the standard Modbus port 502 TCP. Impact: An attacker can exploit this vulnerability to send arbitrary messages to any DCU or RP device through spoofing or replay attacks as long as they have access to the network. Affected releases are Auto-Maskin DCU-210E RP-210E: Versions prior to 3.7 on ARMv7.

Los productos Auto-Maskin emplean un protocolo personalizado sin documentar para establecer comunicaciones Modbus con otros dispositivos sin validarlos. El dispositivo de origen envía un mensaje en texto plano, 48:65:6c:6c:6f:20:57:6f:72:6c:64, "Hello World" mediante los puertos UDP 44444-44446 a la dirección de retransmisión para el LAN. Sin verificación, los dispositivos responden a cualquiera de estos mensajes de transmisión en la red LAN con una respuesta en texto plano mediante UDP conteniendo el modelo del dispositivo y la versión de firmware. Siguiendo este intercambio, los dispositivos permiten las transmisiones Modbus entre los dos dispositivos en el puerto Modbus estándar TCP 502. Impacto: un atacante puede explotar esta vulnerabilidad para enviar mensajes arbitrarios a cualquier dispositivo DCU o RP mediante ataques de suplantación o reproducción durante el tiempo en el que tengan acceso a la red. Las versiones afectadas son Auto-Maskin DCU-210E RP-210E: versiones anteriores a la 3.7 en ARMv7.

*Credits: Reporters: Brian Satira, Brian Olson, Organization: Project Gunsway

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2018-01-12 CVE Reserved
2018-10-08 CVE Published
2024-07-16 EPSS Updated
2024-09-16 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-346: Origin Validation Error

CAPEC

References (2)

URL	Tag	Source
https://www.kb.cert.org/vuls/id/176301	Third Party Advisory
https://www.us-cert.gov/ics/advisories/icsa-20-051-04	X_refsource_misc

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Auto-maskin Search vendor "Auto-maskin"	Rp 210e Firmware Search vendor "Auto-maskin" for product "Rp 210e Firmware"	-	-	Affected	in	Arm Search vendor "Arm"	Arm7 Search vendor "Arm" for product "Arm7"	< 3.7 Search vendor "Arm" for product "Arm7" and version " < 3.7"	-	Safe
Auto-maskin Search vendor "Auto-maskin"	Rp 210e Firmware Search vendor "Auto-maskin" for product "Rp 210e Firmware"	-	-	Affected	in	Auto-maskin Search vendor "Auto-maskin"	Rp 210e Search vendor "Auto-maskin" for product "Rp 210e"	-	-	Safe
Auto-maskin Search vendor "Auto-maskin"	Dcu 210e Firmware Search vendor "Auto-maskin" for product "Dcu 210e Firmware"	-	-	Affected	in	Arm Search vendor "Arm"	Arm7 Search vendor "Arm" for product "Arm7"	< 3.7 Search vendor "Arm" for product "Arm7" and version " < 3.7"	-	Safe
Auto-maskin Search vendor "Auto-maskin"	Dcu 210e Firmware Search vendor "Auto-maskin" for product "Dcu 210e Firmware"	-	-	Affected	in	Auto-maskin Search vendor "Auto-maskin"	Dcu 210e Search vendor "Auto-maskin" for product "Dcu 210e"	-	-	Safe