Date: 2021-01-18
Author: Kevin2600
CVE:
Version: XP-JAVA 2.0
Vendor: https://kaco-newenergy.com
Attack Vector:
The correct credentials will be returned in plain-text from the local server, during the authentication process. Regardless of whatever the passwords have been provided.
Reproduce Steps:
1: Sniffing the authentication process of XP100U by using Wireshark or TCPDump.
2: A request “aci_request_code type=’int’>31<” is sent by XP100U Client.
3: By reversing the java application, we can found that code 31 is used for GET_PASSWORD. And the funny part is this request actually send to the local server.
4: And regardless of whatever the passwords have been provided. The correct credentials will always be returned in PLAIN-TEXT.
Impact-Level:
From search engine Shodan. Currently, around 172 devices exposed to the public on the Internet.
Vendor Response:
The Vendor KACO has been contacted. However no response from them :(
Reference:
https://us-cert.cisa.gov/ics/alerts/ICS-ALERT-15-224-01







365SBOBET Situs Agen Sbobet, Agen Bola Terpercaya di Indonesia
ReplyDelete365sbobet adalah Agen SBOBET Terpercaya Indonesia, Situs Agen Bola Resmi Online Casino Terbaik Official Partner kami adalah Barcelona dan Liverpool.
agen sbobet
sbobet online
situs sbobet
situs sbobet online
situs agen sbobet
situs agen sbobet online
agen slot
slot online
situs slot
situs slot online
situs agen slot
situs agen slot online
Website : CrownQQ Agen DominoQQ BandarQ dan Domino99 Online Terbesar
ReplyDeleteYuk Buruan ikutan bermain di situs CrownQQ
Sekarang CrownQQ Memiliki Game terbaru Dan Ternama loh...
10 permainan :
* Poker Online
* Bandar Poker
* BandarQ
* Domino99
* AduQ
* Sakong
* Capsa Susun
* Bandar66 (ADU BALAK)
* Perang Baccarat
* Perang Dadu (New Games)
Bonus yang diberikan CrownQQ :
* Bonus Rollingan 0.5% Setiap Senin
* Bonus Refferal 20% Seumur Hidup
* Minimal Depo & Withdraw 20.000
* 100% Member Asli
* Pelayanan DP & WD 24 jam
* Livechat Kami 24 Jam Online
Ayo gabung sekarang juga hanya dengan
mengklick daftar crownqq
BACA JUGA BLOGSPORT KAMI:
WinCrownqq
Tips & Trik
Jendela Dunia
Berita dan Info Dunia
Info Lebih lanjut Kunjungi :
WHATSAPP : +6287771354805
LINE : CS CROWNQQ
TELEGRAM : +855882357563
TT4D | TOGEL TERPERCAYA | AGEN TOGEL ONLINE TERPERCAYA DI INDONESIA
ReplyDeleteTT4D Agen Togel Online TerpercayaHadiah Prize
Dengan Fiture-fiture Terbaik sebagai berikut :
• Hadiah 4D Semua Prize Semua Pasaran
• BBFS 10 Digit Tanpa Batasan Line
• Bonus Referral Sebesar 0,5% dari Semua Pemasangan Seumur Hidup
• Tersedia Slot Pragmatic , Jokerslot , Habanero , IDNPLAY
Hadiah & Diskon TT4D :
• HADIAH 4D x 3.000 ( 65% )
• HADIAH 3D x 400 ( 59% )
• HADIAH 2D x 70 ( 29% )
Hadiah Prize 4D ( Tidak Ada 3D 2D ) =
Untuk Semua Pasaran Yang Ada Prize =
Prize II : 200 Ribu ( 4D )
Prize III : 100 Ribu ( 4D
Started Prize : 55 Ribu ( Hanya 4D )
Consolation : 25 Ribu ( 4D )
# Prize di bayar pada Prize tertinggi saja dan tidak berlaku KELIPATAN.
# Hadiah akan masuk ke Akun Setelah Result Pasaran.
PRIZE I NORMAL DISKON 65% HADIAH x 3000 ( 4D )
Website Login / Daftar :
• DAFTAR TT4D
Kontak Official :
- WA : +855963240368
• ALTERNATIF TT4D
Much obliged for tolerating me on your blog. I will carry numerous different bloggers to get your RSS roots to get more educated by your connected articles.
ReplyDeleteI tumble on a rundown of clinical affirmations courses on the web and I have chosen to impart to you the uplifting news since I realize many individuals are looking for occupations on the web, this might assist many individuals with getting utilized straightforwardly abroad.
We have examples of ATTACHED MEDICAL CERTIFICATION COURSES you can use these to get your job abroad, I will also take the advantage to ask for your permission to join our 179.3k members TELEGRAM GROUP
to share with us your ideas or any latest update on your blog.
Thanks I am Scott from Globex, we are expecting you on our platform.
The article was up to the point and described the information very effectively. Thanks to blog author for wonderful and informative post.
ReplyDeletetax consultant in barking