CVE-2024-7395

Executive Summary

CVE-2024-7395 is an authentication bypass vulnerability in the Korenix JetPort 5601v3 serial-to-Ethernet device. The flaw allows an unauthenticated attacker to access device functionality without providing a password. This affects firmware version 1.2 and possibly earlier. The vulnerability is classified under CWE-306 (Missing Authentication for Critical Function). No public proof-of-concept (PoC) or exploit code has been released, and no patch is currently available from the vendor. The CVSS score is 0.0 in the NVD data, but based on the description, a realistic CVSSv3.1 vector would be AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating critical severity.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only affected entity.
• Confidentiality (C): High (H) – Full access to device data.
• Integrity (I): High (H) – Full control over device configuration.
• Availability (A): High (H) – Potential to disrupt device operation.

Threat Level: Critical (9.8) – Immediate risk of full device compromise.

Deep Dive & Mechanics

The JetPort 5601v3 is an industrial serial-to-Ethernet gateway used to connect serial devices (RS-232/422/485) to IP networks. The authentication bypass vulnerability resides in the web management interface or API endpoints. By sending crafted HTTP requests without authentication credentials, an attacker can access administrative functions such as configuration changes, firmware updates, or serial port forwarding settings.

The root cause is the lack of proper session validation or access control checks on sensitive endpoints. The device does not enforce authentication for certain critical operations, allowing unauthenticated requests to be processed as if they came from an admin user.

Vulnerable vs. Patched Code

No patch is available. The vulnerable code likely contains a conditional check that is missing or incorrectly implemented. For example:

Vulnerable (pseudo-code):

def handle_request(endpoint):
    if endpoint == "/admin/config":
        # No authentication check
        return process_config(request)
    else:
        return "Access denied"

Patched (expected):

def handle_request(endpoint):
    if not is_authenticated(request):
        return "401 Unauthorized"
    if endpoint == "/admin/config":
        return process_config(request)
    else:
        return "Access denied"

Exploitation & Lab Setup

Red Team

1. Reconnaissance: Scan for JetPort 5601v3 devices using Shodan dorks: "JetPort 5601v3" or "Korenix JetPort".
2. Direct Access: Send HTTP GET/POST requests to sensitive endpoints without authentication headers.

   curl -X GET http://<target_ip>/admin/config
   curl -X POST http://<target_ip>/firmware_update -d "firmware=malicious.bin"
   

3. Exploitation: If the device responds with configuration data or performs actions, the vulnerability is confirmed. No authentication bypass token is needed.

Blue Team

1. Network Monitoring: Detect anomalous HTTP requests to /admin, /config, /firmware_update, or similar paths from unknown IPs.
2. Log Analysis: Check device logs for unauthenticated access attempts (if logging is enabled).
3. Honeypot: Deploy a decoy JetPort 5601v3 to capture attacker behavior.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /admin/config, /firmware_update, /reboot without Authorization header.
• Logs: Device logs showing [INFO] Unauthenticated request to /admin/config from <IP>.
• Firmware: Unexpected firmware changes or unknown binary uploads.
• Configuration: Unauthorized changes to serial port settings or network parameters.

Detection Engineering

YARA Rule

rule CVE_2024_7395_AuthBypass {
    meta:
        description = "Detects unauthenticated access attempts to JetPort 5601v3 admin endpoints"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-7395"
    strings:
        $admin_path = "/admin/config" ascii wide nocase
        $firmware_path = "/firmware_update" ascii wide nocase
        $reboot_path = "/reboot" ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-7395 Authentication Bypass Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP requests to JetPort 5601v3 admin endpoints without authentication
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-path:
            - '/admin/config'
            - '/firmware_update'
            - '/reboot'
        cs-method: 'GET' or 'POST'
    condition: selection
falsepositives:
    - Legitimate admin access from trusted IPs
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-7395 JetPort 5601v3 Authentication Bypass Attempt"; flow:to_server; content:"/admin/config"; http_uri; nocase; content:"/firmware_update"; http_uri; nocase; content:"/reboot"; http_uri; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Disable remote web access to the device if not required. Use firewall rules to restrict access to trusted IPs only.
• Workaround: Implement network segmentation to isolate the JetPort 5601v3 from untrusted networks.
• Vendor Action: Contact Korenix for a firmware patch. If no patch is available, consider replacing the device with a patched alternative.
• Long-term: Monitor vendor advisories and apply patches as soon as they are released.

Valters IT