PT-2019-13868 · Inea · Me-Rtu

Published

2019-10-28

·

Updated

2024-09-10

·

CVE-2019-14926

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Mitsubishi Electric Europe B.V. ME-RTU devices versions 2.02 and earlier INEA ME-RTU devices versions 3.0 and earlier
Description An issue allows an attacker to gain unauthorized access or disclose encrypted data on the RTU due to hard-coded SSH keys not being regenerated on initial installation or with firmware updates. The devices use private-key values in /etc/ssh/ssh host rsa key, /etc/ssh/ssh host ecdsa key, and /etc/ssh/ssh host dsa key files that are publicly available from the vendor web sites.
Recommendations For Mitsubishi Electric Europe B.V. ME-RTU devices versions 2.02 and earlier, consider regenerating SSH keys on initial installation or with firmware updates to prevent unauthorized access. For INEA ME-RTU devices versions 3.0 and earlier, consider regenerating SSH keys on initial installation or with firmware updates to prevent unauthorized access. As a temporary workaround, consider disabling SSH access to the devices until a patch is available.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2019-14926

Affected Products

Me-Rtu