PT-2024-2277 · Softing · Softing Edgeconnector 840D+5

Cursered + 3 · Published 2024-03-14 · Updated 2024-03-29 · CVE-2024-0860

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:A/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Softing edgeAggregator and Softing edgeConnector modules (affected versions not specified) Softing edgeConnector Modbus (affected versions not specified) Softing edgeConnector 840D (affected versions not specified) Softing edgeConnector Fanuc CNC (affected versions not specified) Softing edgeConnector Siemens (affected versions not specified)

Description The issue is related to the transmission of credentials in cleartext, which may allow a remote attacker to capture packets and craft their own requests, potentially leading to unauthorized access to protected information. This could enable an attacker to bypass authentication.

Recommendations For Softing edgeAggregator, consider disabling the transmission of credentials in cleartext until a patch is available. For Softing edgeConnector modules, restrict access to sensitive information to minimize the risk of exploitation. For Softing edgeConnector Modbus, Softing edgeConnector 840D, Softing edgeConnector Fanuc CNC, and Softing edgeConnector Siemens, avoid using cleartext transmission of credentials in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

BDU:2024-02210

CVE-2024-0860

ZDI-24-353

Affected Products

Softing Edgeaggregator

Softing Edgeconnector

Softing Edgeconnector 840D

Softing Edgeconnector Fanuc Cnc

Softing Edgeconnector Modbus

Softing Edgeconnector Siemens

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2024-0860 · Security Note
• https://bdu.fstec.ru/vul/2024-02210 · Security Note
• https://osv.dev/vulnerability/CVE-2024-0860 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-24-353 · Security Note
• https://claroty.com/team82/disclosure-dashboard/cve-2024-0860 · Note
• https://twitter.com/ianbishop2021/status/1773760955232440579 · Twitter Post
• https://t.me/cvenotify/73905 · Telegram Post
• https://t.me/cvenotify/73841 · Telegram Post
• https://cisa.gov/news-events/ics-advisories/icsa-24-074-13 · Note
• https://industrial.softing.com/uploads/softing_downloads/edgeConnector_ReleaseNotes_V3.80.pdf · Note
• https://twitter.com/CVEnew/status/1768385619649241330 · Twitter Post