CVE-2015-7915
📋 TL;DR
CVE-2015-7915 is a critical vulnerability in Sauter EY-WS505F0x0 moduWeb Vision building automation systems where credentials are transmitted in cleartext over the network. This allows attackers to intercept authentication credentials by sniffing network traffic. Organizations using affected versions of this building management system are at risk.
💻 Affected Systems
- Sauter EY-WS505F0x0 moduWeb Vision
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain administrative access to building automation systems, potentially manipulating HVAC, lighting, security systems, or causing physical damage to equipment.
Likely Case
Attackers steal credentials and gain unauthorized access to building management systems, potentially disrupting operations or using the system as a foothold for further attacks.
If Mitigated
With proper network segmentation and monitoring, impact is limited to credential exposure requiring password resets.
🎯 Exploit Status
Exploitation requires network access to sniff traffic; no authentication bypass needed once credentials are captured.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 1.6.0 and later
Vendor Advisory: https://ics-cert.us-cert.gov/advisories/ICSA-16-033-01
Restart Required: Yes
Instructions:
1. Contact Sauter for version 1.6.0 or later firmware. 2. Backup current configuration. 3. Apply firmware update following vendor instructions. 4. Restart device. 5. Verify functionality.
🔧 Temporary Workarounds
Network Segmentation
allIsolate building automation systems from general corporate networks and internet access.
VPN/Encrypted Tunnel
allRequire all connections to use encrypted VPN tunnels to prevent credential sniffing.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate affected devices
- Monitor network traffic for cleartext credential transmission and alert on detection
🔍 How to Verify
Check if Vulnerable:
Check device firmware version via web interface or serial console; if version is below 1.6.0, device is vulnerable.Check Version:
Check via web interface at http://[device-ip]/ or serial console command depending on configurationVerify Fix Applied:
Confirm firmware version is 1.6.0 or higher and test that credentials are no longer transmitted in cleartext using network sniffing tools.📡 Detection & Monitoring
Log Indicators:
- Failed login attempts from unexpected IP addresses
- Successful logins from unusual locations/times
Network Indicators:
- Cleartext HTTP traffic containing authentication credentials
- Unusual network connections to building automation controllers
SIEM Query:
source_ip IN (building_automation_ips) AND (http_request CONTAINS "password" OR http_request CONTAINS "login")