CVE-2024-36081

Executive Summary

CVE-2024-36081 is a critical vulnerability affecting Westermo EDW-100 serial-to-Ethernet converters. The flaw allows an unauthenticated remote attacker to download the device’s configuration file, which contains credentials in cleartext. With a CVSS score of 9.8, this vulnerability poses a severe risk to operational technology (OT) environments, as it can lead to full device compromise and lateral movement within industrial networks. The vendor has not released a patch, and the device is explicitly not designed for edge deployment, yet many remain exposed.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The threat level is critical due to the lack of authentication required, the cleartext storage of credentials, and the potential for full device takeover. The EPSS score of 0.0% indicates low exploitation likelihood currently, but the public disclosure of the vulnerability increases risk.

Deep Dive & Mechanics

The Westermo EDW-100 is a serial-to-Ethernet converter used to connect legacy serial devices (e.g., PLCs, RTUs) to IP networks. The vulnerability resides in the device’s web interface or management API, which exposes the configuration file without authentication. An attacker can send a simple HTTP GET request to retrieve the configuration, which includes cleartext passwords for device administration and potentially for connected serial devices.

The root cause is the lack of access control on the configuration endpoint and the insecure storage of credentials. The device does not enforce authentication before serving sensitive data, violating fundamental security principles. This is particularly dangerous in OT environments where such devices may bridge critical control networks.

Vulnerable vs. Patched Code

No patch is available. The vulnerable code is the web server implementation that serves the configuration file without authentication. A patched version would require:

• Implementing authentication (e.g., HTTP Basic Auth or session-based) for the configuration endpoint.
• Encrypting stored passwords using a strong hashing algorithm (e.g., bcrypt) instead of cleartext.
• Restricting access to the configuration endpoint to authorized IP addresses or VLANs.

Since no patch exists, the only mitigation is network segmentation and access controls.

Exploitation & Lab Setup

Red Team

Exploitation Steps:

1. Identify Westermo EDW-100 devices on the network using Shodan or Nmap.
2. Send an HTTP GET request to the configuration endpoint:

   curl http://<target-ip>/config.bin -o config.bin
   

   or

   wget http://<target-ip>/config.bin
   

3. Extract cleartext passwords from the downloaded file (e.g., using strings or a hex editor):

   strings config.bin | grep -i password
   

4. Use the extracted credentials to log into the device’s web interface or SSH service.
5. Pivot to connected serial devices or the internal OT network.

Lab Setup:

• Use a virtualized Westermo EDW-100 firmware image (if available) or a real device in an isolated lab.
• Attacker machine: Kali Linux with curl, wget, and strings.
• Network: Isolated VLAN with the device and attacker on the same subnet.

Blue Team

Detection & Response:

• Monitor for HTTP GET requests to /config.bin or similar paths from unauthorized IPs.
• Alert on cleartext password strings in network traffic (e.g., password=, passwd=).
• Use network segmentation to isolate EDW-100 devices from untrusted networks.
• Implement strict firewall rules to allow only necessary traffic (e.g., specific source IPs for management).

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /config.bin or /config on port 80/443.
  • Outbound connections from the device to unknown IPs after exploitation.
  • Cleartext password strings in HTTP responses (e.g., admin:password).
• File IOCs:
  • Configuration file (config.bin) containing cleartext credentials.
  • Unauthorized SSH or web sessions from unknown IPs.
• System IOCs:
  • Unusual device reboots or configuration changes.
  • New user accounts or modified passwords.

Detection Engineering

YARA Rule

rule CVE_2024_36081_Westermo_Config_Leak {
    meta:
        description = "Detects Westermo EDW-100 configuration file containing cleartext passwords"
        author = "Valters IT"
        date = "2024-05-10"
        reference = "CVE-2024-36081"
    strings:
        $password = /password\s*=\s*[^\s]+/ nocase
        $config_header = "EDW-100" nocase
        $cleartext = /passwd|secret|admin/ nocase
    condition:
        $config_header and ($password or $cleartext)
}

Sigma Rule

title: Westermo EDW-100 Configuration File Download Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP GET requests to Westermo EDW-100 configuration endpoint
author: Valters IT
date: 2024-05-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-36081
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem:
            - '/config.bin'
            - '/config'
    condition: selection
falsepositives:
    - Legitimate administrative access from authorized IPs
level: high
tags:
    - attack.initial-access
    - attack.t1190

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-36081 Westermo EDW-100 Config Download Attempt"; flow:to_server; content:"GET"; http_method; content:"/config.bin"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate Actions:
  • Isolate all Westermo EDW-100 devices behind firewalls and VPNs.
  • Restrict management access to trusted IPs only.
  • Disable unused web interfaces or change default ports.
• Long-term:
  • Replace EDW-100 devices with patched or alternative products.
  • Implement network segmentation (e.g., OT-specific VLANs).
  • Use encrypted protocols (HTTPS, SSH) for device management.
• Monitoring:
  • Deploy the provided YARA, Sigma, and Suricata rules.
  • Monitor for unauthorized configuration downloads.
  • Conduct regular vulnerability scans.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert