Hard-Coded FTP Credentials Found in Schneider Electric SCADA Gateway

[Aerosol]

http://trtpost.wpengine.netdna-cdn.com/files/2015/01/FTP_scada-680x400.jpg/img]

The parade of easily exploitable, critical vulnerabilities in ICS software shows no signs of ending anytime soon, with the latest entrant being two flaws in Schneider Electric’s ETG3000 FactoryCast HMI Gateway that allow unauthenticated remote access to the device’s FTP server and configuration file.

The vulnerabilities exist in numerous versions of the gateway, which is used in manufacturing, energy, water and other industries as a Web-based SCADA system. Schneider Electric, based in Paris, has pushed out an updated version of the firmware to fix these vulnerabilities, according to an advisory from ICS-CERT.

“Access to the rde.jar file containing configuration details is accessible without authentication. This could allow an attacker access to information on the setup and configuration of the gateway,” the advisory says.

The vulnerability in the FTP server that runs on the gateway is just as concerning.

“The ftp server of the device has hard-coded credentials. This could allow the attacker to access the service without proper authentication,” the advisory says.

The affected versions are:

• 
  
• TSXETG3000 all versions,
  
• TSXETG3010 all versions,
  
• TSXETG3021 all versions,
  
• TSXETG3022 all versions.
  

Schneider Electric’s update fixes the FTP bug by giving users the ability to disable the FTP server. However, the fix does not remove the hard-coded credentials for the FTP service. To address the configuration file access, the company recommends that customers change the default credentials for the config files.

Source