PT-2021-19745 · Kaco New Energy · Kaco New Energy Xp100U

Aditya K. Sood · Published 2021-02-23 · Updated 2021-02-27 · CVE-2021-3252

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: KACO New Energy XP100U versions up to XP-JAVA 2.0

Description: The issue is related to incorrect access control, where credentials are always returned in plain-text from the local server during the authentication process, regardless of the provided passwords. This leads to an information disclosure issue.

Recommendations: For KACO New Energy XP100U versions up to XP-JAVA 2.0, consider restricting access to the authentication process to minimize the risk of exploitation. As a temporary workaround, avoid using the plain-text credential return feature until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2021-3252

Affected Products

Kaco New Energy Xp100U

References · 6

• 🔥 https://tiger-team-1337.blogspot.com/2021/01/kaco-xp100u-hmi-credential-leak.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-3252 · Security Note
• https://osv.dev/vulnerability/CVE-2021-3252 · Vendor Advisory
• https://t.me/cibsecurity/23992 · Telegram Post
• https://us-cert.cisa.gov/ics/alerts/ICS-ALERT-15-224-01 · Note
• https://twitter.com/Kevin2600/status/1351189347501023238 · Note