Title: WIN-911 - Insecure File Permissions EoP
CWE Class: CWE-276: Incorrect Default Permissions
Date: 05/09/2016
Vendor: Win911
Product: WIN-911 
Type: Alarm Notification Software 
Version: V7.17.00
Download URL: through Rockwell Automation downloads:
http://compatibility.rockwellautomation.com/Pages/MultiProductDownload.aspx?crumb=112
Filter on "win-911", "software", "all families"
Tested on: Windows 7x86 EN
Release mode: no bugbounty program, public release
 
- 1. Product Description: -
The most widely used alarm notification software for the automation industry. 
WIN-911 is used by hundreds of Fortune 500 and Global 500 companies.
 
- 2. Technical Details/PoC: -
This vulnerability allows attackers to escalate their privilege to system administrator 
or SYSTEM on vulnerable installations of Win-911. 
An attacker must have a valid user-account on the system.
 
PoC 1: 
The product is installed under "C:\Program Files\Specter Instruments\WIN-911 V7". 
This directory allows EVERYONE to modify files within this location. 
 
Besides executables running with administrative privileges there are also various services binaries.
These all run as SYSTEM and might be overwritten to obtain SYSTEM level access:
 
C:\Program Files\Specter Instruments\WIN-911 V7\Mobile-911 Bridge Inbound.exe
C:\Program Files\Specter Instruments\WIN-911 V7\Mobile-911 Bridge Outbound.exe
C:\Program Files\Specter Instruments\WIN-911 V7\viewLinc Bridge.exe
 
PoC 2: 
The web-server is installed as a separate component under:
"C:\Program Files\Specter Instruments\WEB-911 Services" 
This directory allows EVERYONE full-control. 
Once exploited, this could affect remote users connecting to the web-server.
 
- 3. Mitigation: -
None. 
If you are brave, edit the permissions. 
Not sure how this impacts the application.
 
- 4. Author: -
sh4d0wman
 
 
################################################################
 
 
Title: WIN-911 - Credential Disclosure
CWE Class: CWE-276: Incorrect Default Permissions | CWE-256: Plaintext Storage of a Password
Date: 05/09/2016
Vendor: Win911
Product: WIN-911 
Type: Alarm Notification Software 
Version: V7.17.00
Download URL: through Rockwell Automation downloads:
http://compatibility.rockwellautomation.com/Pages/MultiProductDownload.aspx?crumb=112
Filter on "win-911", "software", "all families"
Tested on: Windows 7x86 EN
Release mode: no bugbounty program, public release
 
- 1. Product Description: -
The most widely used alarm notification software for the automation industry. 
WIN-911 is used by hundreds of Fortune 500 and Global 500 companies.
 
- 2. Technical Details/PoC: -
This vulnerability allows attackers to obtain certain usernames and passwords on 
vulnerable installations of Win-911.  
An attacker must have a valid user-account on the system.
 
The product is installed under "C:\Program Files\Specter Instruments\WIN-911 V7". 
This directory allows EVERYONE to read and modify files within this location. 
 
During configuration an .ini file is populated with information. 
Some of this information is sensitive.
 
The following settings will log credentials in plain-text: 
FIX Remote Alarm
ArchestrA Direct Connect
viewLinc Direct Connect
WIN911 Pager
E-mail POP and SMTP
 
- 3. Mitigation: -
None yet.
 
- 4. Author: -
sh4d0wman