PT-2018-16944 · Auto Maskin · Auto-Maskin Dcu-210E Rp-210E

Brian Olson + 1 · Published 2018-10-08 · Updated 2019-10-09 · CVE-2018-5400

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Auto-Maskin DCU-210E RP-210E versions prior to 3.7 on ARMv7.

Description The issue arises from the use of an undocumented custom protocol for setting up Modbus communications, which lacks validation of devices. An originating device sends a plaintext message, 48:65:6c:6c:6f:20:57:6f:72:6c:64, or "Hello World" over UDP ports 44444-44446 to the LAN's broadcast address. Devices on the LAN respond to these messages without verification, sending a plaintext reply containing the device model and firmware version over UDP. This exchange allows Modbus transmissions between devices on the standard Modbus port 502 TCP. An attacker can exploit this to send arbitrary messages to any DCU or RP device through spoofing or replay attacks, provided they have network access.

Recommendations For Auto-Maskin DCU-210E RP-210E versions prior to 3.7 on ARMv7, update to version 3.7 or later to resolve the issue. As a temporary workaround, consider restricting access to UDP ports 44444-44446 and the standard Modbus port 502 TCP to minimize the risk of exploitation.

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

CVE-2018-5400

Affected Products

Auto-Maskin Dcu-210E Rp-210E

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-5400 · Security Note
• https://kb.cert.org/vuls/id/176301 · Note
• https://us-cert.gov/ics/advisories/icsa-20-051-04 · Note