CVE-2024-7396

Executive Summary

CVE-2024-7396 identifies a critical security flaw in the Korenix JetPort 5601v3 serial-to-Ethernet device server, affecting all firmware versions up to and including 1.2. The vulnerability stems from the missing encryption of sensitive data during network communication, enabling a network-based attacker to perform eavesdropping attacks. This allows the adversary to passively capture and read all unencrypted traffic, including credentials, configuration data, and serial payloads transmitted between the device and management stations.

The lack of encryption (CWE-311) violates fundamental security principles for industrial control systems (ICS) and operational technology (OT) environments. As of this report, no official patch has been released by Korenix, and no public proof-of-concept (PoC) exploit code is available. The EPSS score is 0.0%, indicating low active exploitation in the wild, but the risk is elevated in exposed OT networks.

Impact: An attacker with network access to the JetPort 5601v3 can silently capture all plaintext communications, leading to credential theft, configuration disclosure, and potential lateral movement within the ICS network.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, which is likely a placeholder. Based on the vulnerability description, a more realistic assessment is:

• Attack Vector (AV): Network (N) – exploitable remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no authentication needed to eavesdrop.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Unchanged (U) – the vulnerable component is the only affected asset.
• Confidentiality (C): High (H) – all transmitted data is exposed.
• Integrity (I): None (N) – no data modification.
• Availability (A): None (N) – no denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Estimated Base Score: 7.5 (High)

Threat Level: High for confidentiality, Low for integrity/availability. The primary threat is passive data exfiltration.

Deep Dive & Mechanics

The Korenix JetPort 5601v3 is a serial device server that converts RS-232/422/485 serial data to Ethernet (TCP/IP). It is commonly used in industrial automation, SCADA, and remote telemetry applications. The vulnerability lies in the application-layer protocol used for management and data relay.

Root Cause: The device does not enforce or support encryption (e.g., TLS/SSL, SSH) for any of its network services, including:

• Web Management Interface (HTTP): Plaintext transmission of login credentials and configuration.
• Serial-over-TCP (Raw TCP or RFC 2217): Serial data is sent as plaintext over the network.
• Telnet/CLI: If enabled, all commands and responses are unencrypted.

Attack Vector: An attacker positioned on the same network segment (e.g., via ARP spoofing, rogue access point, or compromised switch) can passively capture packets using tools like Wireshark or tcpdump. No active exploitation is required—simple eavesdropping suffices.

Technical Flow:

1. The JetPort 5601v3 listens on TCP ports (e.g., 80 for HTTP, 23 for Telnet, 4000-4003 for serial data).
2. A legitimate client (e.g., a SCADA host or administrator) connects to the device.
3. All data exchanged is transmitted in cleartext.
4. The attacker captures the traffic and extracts sensitive information.

Vulnerable vs. Patched Code

Since this is a firmware-level vulnerability and no patch is available, a code comparison is not possible. However, the conceptual difference is:

Vulnerable (Firmware <= 1.2):

• All network services use plaintext protocols (HTTP, Telnet, raw TCP).
• No encryption options are available in the web interface or CLI.

Patched (Hypothetical):

• Web interface enforces HTTPS with a self-signed or user-provided certificate.
• Serial data streams are encapsulated in TLS (e.g., RFC 2217 over TLS).
• Telnet is replaced with SSH.
• Configuration options to disable unencrypted services.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Environment:

• 1x Korenix JetPort 5601v3 (firmware 1.2)
• 1x Attacker machine (Kali Linux)
• 1x Victim machine (Windows/Linux with JetPort management software)
• Network switch (managed, with port mirroring or SPAN)

Steps:

1. Network Reconnaissance:

   nmap -p 80,23,4000-4003 <target_ip>
   

   Identify open ports and services.

2. Passive Eavesdropping:

   tcpdump -i eth0 -w capture.pcap host <target_ip>
   

   Capture all traffic to/from the JetPort.

3. Credential Harvesting: Use Wireshark to filter HTTP POST requests:

   tshark -r capture.pcap -Y "http.request.method == POST" -T fields -e http.file_data
   

   Extract login credentials from the web interface.

4. Serial Data Interception: If serial data is transmitted over raw TCP (e.g., port 4001), filter:

   tshark -r capture.pcap -Y "tcp.port == 4001" -x
   

   This reveals plaintext serial commands and responses.

Blue Team (Defensive)

Detection & Response:

1. Network Monitoring:

   • Deploy IDS/IPS rules to detect plaintext protocols on expected encrypted ports.
   • Monitor for unusual traffic patterns to the JetPort (e.g., multiple connections from unknown IPs).

2. Configuration Hardening:

   • If possible, isolate the JetPort on a dedicated VLAN with strict ACLs.
   • Disable Telnet and HTTP if not required; use SSH and HTTPS if supported (check firmware).
   • Use a VPN or IPsec tunnel for all management traffic.

3. Traffic Analysis:

   • Look for cleartext credentials in HTTP POST requests.
   • Alert on any serial data streams that are not encapsulated in TLS.

Indicators of Compromise (IOCs)

Network IOCs:

• Plaintext HTTP traffic to/from the JetPort (port 80).
• Telnet sessions (port 23) without encryption.
• Raw TCP serial data streams (ports 4000-4003) in cleartext.
• Unusual ARP requests (potential ARP spoofing) targeting the JetPort.

Host IOCs:

• Unauthorized pcap files on the network.
• Wireshark or tcpdump processes on non-administrator machines.
• Logs showing repeated failed login attempts (if brute-forcing).

File IOCs:

• Captured pcap files containing JetPort traffic.
• Extracted credential files (e.g., creds.txt).

Detection Engineering

YARA Rule

rule CVE_2024_7396_JetPort_Eavesdropping {
    meta:
        description = "Detects plaintext credentials in HTTP traffic to Korenix JetPort 5601v3"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-7396"
    strings:
        $http_post = "POST /" ascii
        $login_field = "username=" ascii
        $password_field = "password=" ascii
        $jetport_header = "JetPort" ascii
    condition:
        all of ($http_post, $login_field, $password_field) or
        ($http_post and $jetport_header)
}

Sigma Rule

title: Korenix JetPort 5601v3 Plaintext Credential Detection
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects plaintext HTTP POST requests containing credentials to a Korenix JetPort device
author: Valters IT
date: 2025-04-10
logsource:
    category: network
    product: suricata
detection:
    selection:
        http.method: 'POST'
        http.url|contains: '/'
        http.request_body|contains: 'username='
        http.request_body|contains: 'password='
    condition: selection
falsepositives:
    - Legitimate admin login (still a risk)
level: high
tags:
    - attack.t1040
    - cve.2024.7396

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 80 (msg:"CVE-2024-7396 Korenix JetPort Plaintext Credential Leak"; flow:to_server,established; content:"POST"; http_method; content:"username="; http_client_body; content:"password="; http_client_body; reference:cve,2024-7396; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Network Segmentation: Place the JetPort 5601v3 on an isolated VLAN with strict firewall rules. Only allow management traffic from trusted IPs.
2. Disable Unencrypted Services: If the firmware allows, disable HTTP and Telnet. Use only SSH and HTTPS if available.
3. VPN Tunneling: Route all management and serial traffic through an encrypted VPN (e.g., WireGuard, OpenVPN).
4. Monitor Traffic: Deploy the above detection rules to alert on plaintext credentials.

Long-Term Fix:

• Contact Korenix for a firmware update. If none is available, consider replacing the device with a model that supports TLS/SSH encryption.
• Implement a security policy requiring encryption for all OT network communications.

Workaround:

• Use a network-level encryption proxy (e.g., stunnel) to wrap the JetPort's traffic in TLS.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert