CVE-2024-2371

Executive Summary

CVE-2024-2371 exposes a critical information disclosure vulnerability in the Korenix JetI/O 6550 industrial I/O device running firmware version F208 Build:0817. The vulnerability stems from the device’s SNMP service transmitting credentials and sensitive data in cleartext over the network. An attacker with network access to the SNMP port (UDP 161) can passively intercept traffic and extract credentials, leading to unauthorized device access and potential lateral movement within an OT/ICS environment. The CVSS score of 6.2 (Medium) reflects the high confidentiality impact but low attack complexity. No public exploit code or patch is currently available, making this a high-priority monitoring and mitigation issue for asset owners.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in an industrial IoT device.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 6.2 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability is exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed to initiate the attack.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The impact is confined to the vulnerable component.
• Confidentiality Impact: High (C:H) – Credentials and sensitive data are exposed.
• Integrity Impact: None (I:N) – No data modification possible.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The lack of public exploit code and low EPSS score (0.0%) reduce immediate risk, but the ease of passive sniffing and the criticality of exposed credentials in OT environments elevate the threat for targeted attacks.

Deep Dive & Mechanics

The Korenix JetI/O 6550 is an industrial Ethernet I/O device used for remote monitoring and control in automation systems. The SNMP (Simple Network Management Protocol) service, typically running on UDP port 161, is configured to transmit community strings (passwords) and other management data in cleartext. This is a fundamental protocol design flaw when SNMPv1 or SNMPv2c is used without encryption.

Attack Flow:

1. Reconnaissance: An attacker scans for devices with SNMP port 161 open (e.g., using Shodan or Nmap).
2. Interception: Using a packet capture tool (e.g., tcpdump, Wireshark), the attacker passively monitors SNMP traffic to and from the device.
3. Credential Extraction: The attacker parses the captured packets to extract the read/write community strings (e.g., "public", "private", or custom strings).
4. Exploitation: With the community strings, the attacker can query or modify device settings, potentially disrupting operations or pivoting to other network segments.

The vulnerability is inherent to the firmware’s use of SNMP without encryption (no SNMPv3 support or misconfiguration). No authentication or encryption is applied to SNMP messages.

Vulnerable vs. Patched Code

Vulnerable Configuration (F208 Build:0817):

• SNMP service enabled with SNMPv1/v2c.
• Community strings transmitted in cleartext.
• No SNMPv3 support or TLS/DTLS encryption.

Patched Configuration (Hypothetical):

• SNMPv3 enabled with authentication (SHA) and encryption (AES).
• Community strings replaced by user-based security model (USM).
• Alternatively, SNMP disabled and replaced with encrypted protocols (e.g., HTTPS, MQTT with TLS).

Since no official patch is available, the "patched" state is theoretical. The fix would involve firmware update to support SNMPv3 or disabling SNMP entirely.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Environment:

• Target: Korenix JetI/O 6550 with firmware F208 Build:0817.
• Attacker: Kali Linux machine on the same network segment.
• Tools: tcpdump, Wireshark, snmpwalk, onesixtyone.

Step-by-Step Exploitation:

1. Network Discovery:

   nmap -sU -p 161 --open <target_ip>
   

2. Passive Sniffing:

   tcpdump -i eth0 -X -s 0 port 161
   

3. Active Community String Brute-Force (if needed):

   onesixtyone -c /usr/share/wordlists/snmp-community.txt <target_ip>
   

4. Extract Credentials from Capture: Use Wireshark to filter snmp and inspect packets for community strings in the "community" field.

5. Post-Exploitation:

   snmpwalk -v2c -c <community_string> <target_ip> 1.3.6.1.2.1.1
   

Expected Output: Community strings (e.g., "public", "private") visible in plaintext in packet payloads.

Blue Team (Defensive)

Detection & Response:

1. Network Monitoring:

   • Alert on SNMP traffic (UDP 161) from unauthorized sources.
   • Monitor for SNMP community string brute-force attempts (high rate of SNMP requests).

2. Honeypot Deployment:

   • Deploy a fake JetI/O device on the network to capture attacker behavior.

3. Log Analysis:

   • Check device logs for repeated SNMP authentication failures (if logging enabled).

4. Mitigation Steps:

   • Disable SNMP if not required.
   • If SNMP is necessary, restrict access via firewall rules to trusted IPs only.
   • Implement network segmentation to isolate OT devices.

Indicators of Compromise (IOCs)

• Network IOCs:

  • SNMP traffic (UDP 161) containing cleartext community strings.
  • Unusual SNMP GET/GETNEXT requests from unknown IPs.
  • High volume of SNMP packets from a single source (brute-force).

• Host IOCs:

  • Device configuration changes via SNMP SET commands.
  • Unauthorized SNMP community strings in device configuration.

• File IOCs:

  • Packet capture files (pcap) containing SNMP community strings.

• Behavioral IOCs:

  • SNMP service responding to queries from outside the trusted management network.

Detection Engineering

YARA Rule

rule CVE_2024_2371_SNMP_Cleartext_Credentials {
    meta:
        description = "Detects SNMP packets containing cleartext community strings indicative of CVE-2024-2371"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-2371"
    strings:
        $snmp_community = /public|private|[\x20-\x7e]{1,32}/ ascii wide
        $snmp_header = { 30 ?? 02 01 00 04 }
    condition:
        $snmp_header and $snmp_community
}

Sigma Rule

title: SNMP Cleartext Community String Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SNMP packets containing cleartext community strings (CVE-2024-2371)
author: Valters IT
date: 2025/04/10
logsource:
    category: network_flow
    product: zeek
detection:
    selection:
        service: snmp
        community: "public" or "private"
    condition: selection
falsepositives:
    - Legitimate SNMP monitoring tools
level: medium

Suricata Rule

alert udp $HOME_NET any -> $EXTERNAL_NET 161 (msg:"CVE-2024-2371 SNMP Cleartext Community String"; content:"|30 02 01 00 04|"; depth:5; content:"public"; distance:0; within:10; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable SNMP: If SNMP is not required for operations, disable the service entirely via the device web interface or CLI.
2. Restrict Access: Use firewall rules to allow SNMP traffic only from trusted management IPs.
3. Network Segmentation: Place the JetI/O device on a dedicated OT VLAN with strict access controls.

Long-Term Fixes:

• Firmware Update: Monitor Korenix for a firmware patch that enables SNMPv3 with encryption. If no patch is released, consider replacing the device.
• Encrypted Alternatives: Migrate to encrypted protocols (e.g., HTTPS, MQTT with TLS) for device management.
• Monitoring: Deploy network monitoring tools to detect cleartext SNMP traffic and alert on anomalies.

Workarounds:

• Use SNMPv3 if the device supports it (check firmware documentation).
• Implement a VPN tunnel for all management traffic to the device.

Valters IT