Summary
In ifm Smart PLC firmware up to version 4.3.17 for Smart PLC controllers AC14xx and AC4xxS, an attacker can access the configuration by using the hardcoded credentials. The endpoint hosts a scripts capable of executing various commands.
Details
Impact
Please see the CVE description.
Mitigation
When using automation components, make sure that no unauthorized access can take place. Addition measures should be taken to ensure that the components do not have direct access to Internet resources and that they cannot be accessed from insecure networks. Use available security measures such as authentication and authorization groups.
Remediation
Update to Firmware Version 6.1.8 or later.
Vulnerabilities 5
-
Critical 9.8
ifm: Use of Hard-coded Credentials
An unauthenticated remote attacker can use the hard-coded credentials to access the SmartSPS devices with high privileges.
-
Critical 9.1
ifm: Hardcoded telnet credentials in Smart PLC
An high privileged remote attacker can enable telnet access that accepts hardcoded credentials.
-
High 7.2
ifm: Reading function in Smart PLC allows command injections
A remote attacker with high privileges may use a reading file function to inject OS commands.
-
High 7.2
ifm: Writing file function in Smart PLC allows command injections
A remote attacker with high privileges may use a writing file function to inject OS commands.
-
High 7.2
ifm: Deleting function in Smart PLC allows command injections
A remote attacker with high privileges may use a deleting file function to inject OS commands.
Revision history
-
#3.0.0
Update Product information
-
#2.0.0
Fixed Version range, Added Score to Vulnerability CVE-2024-28750, deleted "firmware" from the full product name of the hardware, changed Vulnerability title to CVE description
-
#1.1.0
Update: CWE from CVE-2024-28751, Revision History
-
#1.0.0
Initial revision.
References
-
VDE-2024-012: ifm: Vulnerabilities in ifm AC14 firmware - HTML
https://certvde.com/en/advisories/VDE-2024-012/
-
Vendor PSIRT
https://www.ifm.com
-
CERT@VDE Security Advisories for ifm electronic GmbH
https://certvde.com/en/advisories/vendor/ifm/