CVE-2025-54810

Executive Summary

CVE-2025-54810 exposes a critical security flaw in Cognex In-Sight Explorer and In-Sight Camera Firmware. The vulnerability resides in a proprietary protocol exposed on TCP port 1069, which is used for management operations such as modifying system properties. The user management functionality transmits sensitive data—including registered usernames and passwords—over an unencrypted channel. This allows an adjacent attacker to intercept valid credentials via network sniffing, leading to full device compromise. With a CVSS score of 8.0, the vulnerability is considered high severity, though the EPSS score is currently 0.0%, indicating low exploitation likelihood in the wild. No public proof-of-concept or patch details are available at this time.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects proprietary industrial control system (ICS) firmware and software from Cognex, specifically the In-Sight product line. Organizations using Cognex In-Sight cameras should treat this as a critical supply chain risk, as compromised devices could be used as a pivot point into OT networks.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 8.0 (High)
• Attack Vector (AV): Adjacent Network (AV:A) – The attacker must be on the same network segment as the target device.
• Attack Complexity (AC): Low (AC:L) – No special conditions or race conditions required.
• Privileges Required (PR): None (PR:N) – No authentication needed to initiate the attack.
• User Interaction (UI): None (UI:N) – No user action required.
• Scope (S): Unchanged (S:U) – The vulnerability does not affect resources beyond the vulnerable component.
• Confidentiality (C): High (C:H) – Credentials are fully exposed.
• Integrity (I): High (I:H) – An attacker can modify system properties.
• Availability (A): High (A:H) – Full device control could lead to denial of service.

Threat Level: High. The lack of encryption on a management protocol handling credentials is a fundamental design flaw. While the attack vector is adjacent, in many industrial environments, the OT network is isolated but not necessarily segmented from other adjacent devices.

Deep Dive & Mechanics

The vulnerability stems from the proprietary protocol used by Cognex In-Sight devices on TCP port 1069. This protocol is designed for remote management, including reading and writing system properties. The user management sub-functionality handles authentication data (usernames and passwords) in plaintext.

Technical Flow:

1. An administrator or management software connects to the device on TCP 1069.
2. The client sends a login request containing the username and password.
3. The device responds with a success/failure message, but the credentials are transmitted without any encryption (e.g., TLS, SSL, or even simple obfuscation).
4. An attacker on the same network segment can use a packet sniffer (e.g., Wireshark, tcpdump) to capture the plaintext credentials.
5. With valid credentials, the attacker can authenticate to the device and execute any management operation, including modifying firmware settings, disabling security features, or exfiltrating data.

Root Cause: The protocol was designed without considering encryption for authentication data. This is a classic case of CWE-319 (Cleartext Transmission of Sensitive Information).

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable behavior versus expected secure behavior.

Vulnerable Code (Conceptual):

# Pseudocode for vulnerable authentication handler
def handle_login(socket, username, password):
    # Credentials sent in cleartext
    send(socket, f"LOGIN:{username}:{password}")
    response = recv(socket)
    if response == "SUCCESS":
        return True
    return False

Patched Code (Expected):

# Pseudocode for patched authentication handler
import ssl

def handle_login(socket, username, password):
    # Wrap socket with TLS
    context = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH)
    secure_socket = context.wrap_socket(socket, server_side=True)
    # Credentials sent over encrypted channel
    send(secure_socket, f"LOGIN:{username}:{password}")
    response = recv(secure_socket)
    if response == "SUCCESS":
        return True
    return False

The patched version would require TLS/SSL encryption for the entire session, ensuring credentials are not transmitted in cleartext.

Exploitation & Lab Setup

Red Team (Attacker) Perspective

Lab Setup:

• Target: Cognex In-Sight camera with firmware vulnerable to CVE-2025-54810.
• Attacker: Kali Linux machine on the same network segment.
• Tools: Wireshark, tcpdump, netcat, Python.

Exploitation Steps:

1. Network Discovery: Scan for devices on TCP port 1069.

   nmap -p 1069 --open 192.168.1.0/24
   

2. Capture Traffic: Use tcpdump to capture packets to/from the target.

   tcpdump -i eth0 host 192.168.1.100 and port 1069 -w capture.pcap
   

3. Trigger Login: Simulate a login attempt (e.g., by connecting with a management tool or using a script).

   import socket
   s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
   s.connect(("192.168.1.100", 1069))
   s.send(b"LOGIN:admin:password123")
   print(s.recv(1024))
   s.close()
   

4. Extract Credentials: Open the pcap in Wireshark and filter for tcp.port == 1069. Look for the plaintext login string.
5. Authenticate: Use the captured credentials to connect and execute commands.

   echo "SET_PROPERTY:admin:password123:system.timezone=UTC" | nc 192.168.1.100 1069
   

Blue Team (Defender) Perspective

Detection:

• Monitor for connections to TCP port 1069 from unexpected hosts.
• Alert on plaintext credentials in network traffic (e.g., using Suricata rules).
• Enable logging on the device if possible (though limited).

Mitigation:

• Isolate the OT network from other segments.
• Use VLANs or firewall rules to restrict access to port 1069 to only authorized management stations.
• Monitor for anomalous traffic patterns on port 1069.

Indicators of Compromise (IOCs)

• Network IOCs:
  • TCP connections to port 1069 on Cognex In-Sight devices.
  • Plaintext strings containing "LOGIN:" followed by username:password in network traffic.
  • Unusual outbound connections from the device to unknown IPs (post-compromise).
• Host IOCs:
  • Unauthorized changes to system properties (e.g., time zone, network settings).
  • New user accounts created on the device.
• File IOCs:
  • Packet capture files (pcap) containing the plaintext credentials.

Detection Engineering

YARA Rule

rule CVE_2025_54810_Cognex_Credential_Sniffing {
    meta:
        description = "Detects plaintext credentials in Cognex In-Sight protocol on TCP 1069"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-54810"
    strings:
        $login_pattern = /LOGIN:[A-Za-z0-9_]+:[A-Za-z0-9_!@#$%^&*()]+/
    condition:
        $login_pattern
}

Sigma Rule

title: Cognex In-Sight Plaintext Credential Transmission
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects plaintext credentials in Cognex In-Sight protocol traffic on TCP port 1069
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: suricata
detection:
    selection:
        dest_port: 1069
        payload|contains: "LOGIN:"
    condition: selection
falsepositives:
    - Legitimate management traffic (should be encrypted in future)
level: high

Suricata Rule

alert tcp any any -> any 1069 (msg:"CVE-2025-54810 Cognex In-Sight Plaintext Credential Transmission"; flow:to_server,established; content:"LOGIN:"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Network Segmentation: Isolate Cognex In-Sight devices on a dedicated VLAN with strict firewall rules allowing only authorized management stations to access TCP port 1069.
2. Encryption Tunneling: Use a VPN or SSH tunnel to encrypt management traffic to the devices until a firmware patch is available.
3. Monitor Traffic: Deploy the provided Suricata/Sigma rules to detect any plaintext credential transmission.
4. Change Default Credentials: Ensure all devices have strong, unique passwords and change them regularly.

Long-Term Fix:

• Vendor Patch: Await an official firmware update from Cognex that implements TLS/SSL encryption for the management protocol.
• Protocol Upgrade: If possible, disable the proprietary protocol and use secure alternatives (e.g., HTTPS-based management).

Workarounds:

• Disable remote management if not required.
• Use network access control (NAC) to restrict device connectivity.

Valters IT