CVE-2017-11165
📋 TL;DR
CVE-2017-11165 allows remote attackers to retrieve sensitive configuration files including credentials from DataTaker DT80 dEX devices by directly accessing a specific URL. This affects all systems running the vulnerable firmware version that are network-accessible. Attackers can obtain administrative credentials and device configuration without authentication.
💻 Affected Systems
- DataTaker DT80 dEX
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full device compromise leading to data manipulation, industrial process disruption, or use as an attack pivot point within operational technology networks.
Likely Case
Credential theft enabling unauthorized access to the device, configuration modification, or data exfiltration.
If Mitigated
Limited to reconnaissance only if proper network segmentation and access controls prevent exploitation.
🎯 Exploit Status
Exploitation requires only a web browser or curl command to access the vulnerable URL. Multiple public exploit scripts exist.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Later versions than 1.50.012
Vendor Advisory: https://www.schneider-electric.com/en/download/document/SEVD-2017-173-01/
Restart Required: Yes
Instructions:
1. Contact Schneider Electric/DataTaker support for updated firmware. 2. Backup current configuration. 3. Apply firmware update following vendor instructions. 4. Restart device. 5. Verify fix by attempting to access /services/getFile.cmd?userfile=config.xml
🔧 Temporary Workarounds
Network Access Restriction
linuxBlock external access to DT80 web interface using firewall rules
iptables -A INPUT -p tcp --dport 80 -s ! trusted_network -j DROP
iptables -A INPUT -p tcp --dport 443 -s ! trusted_network -j DROP
Web Server Configuration
allIf possible, configure web server to restrict access to /services/getFile.cmd endpoint
🧯 If You Can't Patch
- Isolate DT80 devices in separate VLAN with strict firewall rules allowing only necessary communications
- Implement network monitoring for access attempts to /services/getFile.cmd endpoint
🔍 How to Verify
Check if Vulnerable:
Attempt to access http://[device_ip]/services/getFile.cmd?userfile=config.xml. If XML configuration file downloads, device is vulnerable.Check Version:
Check device web interface or use SNMP to query system versionVerify Fix Applied:
After patching, attempt the same access. Should return error or access denied instead of configuration file.📡 Detection & Monitoring
Log Indicators:
- HTTP GET requests to /services/getFile.cmd in web server logs
- Unauthenticated access attempts from unexpected IP addresses
Network Indicators:
- HTTP requests to /services/getFile.cmd?userfile=config.xml
- Traffic patterns showing configuration file downloads
SIEM Query:
source="web_logs" AND uri="/services/getFile.cmd" AND query="userfile=config.xml"🔗 References
- https://packetstormsecurity.com/files/143328/DataTaker-DT80-dEX-1.50.012-Sensitive-Configuration-Exposure.html
- https://www.exploit-db.com/exploits/42313/
- https://packetstormsecurity.com/files/143328/DataTaker-DT80-dEX-1.50.012-Sensitive-Configuration-Exposure.html
- https://www.exploit-db.com/exploits/42313/
