Serial-to-Ethernet adapters are full of vulnerabilities

Serial-to-Ethernet adapters used in industrial, retail and healthcare environments to connect serial devices to TCP/IP networks are riddled with vulnerabilities and outdated open source components, researchers warn. These weaknesses allow a variety of attack scenarios, including complete control of critical equipment such as remote terminal units, programmable logic controllers, point-of-sale systems and patient monitors.

See also: Microsoft: Emergency update for vulnerability in ASP.NET Core

In a new study called BRIDGE:BREAK, researchers at cybersecurity firm Forescout analyzed firmware from five major serial-to-IP adapter and found that each firmware image contained an average of 80 open source software components with nearly 2,500 known vulnerabilities and 89 publicly available exploits. In addition, the researchers identified 22 new vulnerabilities in three devices from Lantronix and Silex Technology America with impacts ranging from remote code execution to authentication bypass, information disclosure, and denial of service.

Search engines like Shodan show nearly 20,000 serial-to-Ethernet adapters exposed online, although the number of these devices deployed within networks is likely in the millions, as they are used across many industries. But even when they are not directly connected to the internet, attackers can reach these devices after compromising internal networks through various other initial access routes.

Because serial protocols often lack authentication or encryption, “attackers can alter serial data received from a sensor as it travels across the IP network,” the researchers said. “For example, changing patient temperature, pressure, humidity, flow, or heart rate measurements to arbitrary values. Conversely, attackers can modify commands traveling from the IP network to the serial side before they reach an actuator.”

Serial-to-IP converters have been targeted in real-world attacks on critical infrastructure in the past. For example, in a 2015 cyberattack that disrupted power distribution at several substations in Ukraine, attackers uploaded corrupted firmware to Moxa serial-to-IP converters via the firmware update function.

The firmware on the devices analyzed by Forescout ran old versions of the Linux kernel as well as other outdated libraries and user binaries. In addition, half of the Linux kernel branches observed were at end-of-life, making future updates difficult. As a result, the analyzed firmware images had an average of over 2,000 known vulnerabilities, most of which were found in the Linux kernel itself.

See also: Apache ActiveMQ vulnerability affects 6,400 servers

Due to the old kernel versions used, the anti-exploits implemented at the operating system level for the binaries were also highly inconsistent. Only 23% of the firmware images used stack canaries, a feature that prevents stack smashing exploits. 44% used RELRO (Relocation Read-Only), which prevents attackers from redirecting execution by overwriting the Global Offset Table.

In addition to all known vulnerabilities from open source components, Forescout researchers also performed manual security analysis and identified previously unknown weaknesses in the firmware of three specific devices from two vendors: Lantronix EDS3000PS Series, Lantronix EDS5000 Series , and Silex SD330-AC.

The Lantronix EDS5000 web management interface had five vulnerabilities across multiple pages and fields caused by a lack of input sanitization that could lead to remote code execution as root.

The Lantronix EDS3000PS had an RCE, an authentication bypass issue, and a device takeover vulnerability where the password change function did not prompt for the old password, potentially allowing attackers to change the password for the administrator account. While the Lantronix vulnerabilities were all in the web interface, some of the 12 vulnerabilities found in the Silex SD-330AC were in various network services, exploitable via UDP packets.

In total, the researchers found three new RCE vulnerabilities, an authentication bypass, an arbitrary file upload issue that could allow unauthenticated attackers to upload firmware binaries, two device hijacking and privilege escalation vulnerabilities, two configuration tampering vulnerabilities, and other issues that could lead to information disclosure and denial of service.

Both Lantronix and Silex have already released firmware updates to address the reported vulnerabilities: SD-330AC Firmware version 1.50, EDS5000 series version 2.2.0.0R1 , and EDS3000 series version 3.2.0.0R2.

See also: Cisco: Fixes 4 critical vulnerabilities in Identity Services and Webex

In addition to updating, Forescout recommends:

• Replace default credentials and prohibit weak passwords to reduce the risk of exploiting authenticated vulnerabilities
• Network segmentation to prevent threat actors from accessing vulnerable serial-to-IP converters or using these devices to compromise other critical assets
• Ensuring they are not exposed online
• Implement strict access controls for administrative interfaces (such as the Web UI) so that only pre-approved administrative workstations can access them
• Use dedicated subnets or VLANs where only communication with the serial devices they manage and the IP-side devices that need to access that serial data is allowed
• Monitor for exploit attempts on serial-to-IP converters and for unusual communication patterns that suggest an attacker is targeting data being read from, or sent to, the serial connection.