Summary
Successful exploitation of this vulnerability could allow a remote attacker to reconfigure devices, update firmware, and manipulate connected systems without any credentials.
Vulnerabilities 1
-
Critical 9.3
Iskra iHUB and iHUB Lite has a Missing Authentication for Critical Function vulnerabilitiy
The Iskra iHUB and iHUB Lite smart metering gateway exposes its web management interface without requiring authentication, allowing unauthenticated users to access and modify critical device settings.
Revision history
-
#1
Initial Publication
References
-
ICSA Advisory ICSA-25-336-02 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-25-336-02
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
-
Recommended Practices
https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b
-
Recommended Practices
https://www.cisa.gov/secure-our-world/teach-employees-avoid-phishing
-
Recommended Practices
https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks