CVE-2017-11349
📋 TL;DR
CVE-2017-11349 allows remote attackers to compose and execute programs or schedules on dataTaker DT8x dEX devices, enabling actions like sending unauthorized emails or making outbound FTP connections. This affects organizations using vulnerable versions of these industrial data loggers for environmental monitoring or industrial control systems.
💻 Affected Systems
- Thermo Fisher Scientific dataTaker DT8x dEX
📦 What is this software?
Dt8x Firmware by Datataker
⚠️ Risk & Real-World Impact
Worst Case
Attackers could use the device as a pivot point to access internal networks, exfiltrate sensitive data via FTP/email, or disrupt industrial processes by modifying data collection schedules.
Likely Case
Unauthorized data exfiltration from the device or using it as a spam/relay node for malicious communications.
If Mitigated
Limited impact if device is isolated in a segmented network with strict outbound firewall rules.
🎯 Exploit Status
Public proof-of-concept demonstrates remote program composition via HTTP requests; no authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No public vendor advisory found
Restart Required: No
Instructions:
Contact Thermo Fisher Scientific for updated firmware or mitigation guidance.
🔧 Temporary Workarounds
Network Segmentation
allIsolate dataTaker devices in separate VLANs with strict firewall rules blocking all inbound/outbound traffic except essential protocols.
Disable Remote Management
allConfigure devices to only allow local serial connections if remote access isn't required.
🧯 If You Can't Patch
- Implement strict network access controls allowing only trusted IPs to communicate with the device
- Monitor outbound connections from the device for unexpected FTP/email traffic
🔍 How to Verify
Check if Vulnerable:
Check device web interface version or attempt to access program composition features remotely via HTTP.Check Version:
Check device web interface or serial console for firmware version informationVerify Fix Applied:
Verify device firmware version is newer than 1.72.007 or test that remote program composition is no longer possible.📡 Detection & Monitoring
Log Indicators:
- Unexpected program/schedule creation logs
- Unauthorized FTP/email connection attempts from device
Network Indicators:
- HTTP POST requests to device program composition endpoints
- Unexpected outbound FTP/SMTP traffic from device IP
SIEM Query:
source_ip=[device_ip] AND (http_method=POST AND uri_contains="program" OR dest_port IN (21,25,587))