CVE-2017-14021
📋 TL;DR
This CVE involves hard-coded cryptographic keys in multiple Korenix JetNet industrial switches, allowing attackers to extract certificates and private keys. This enables man-in-the-middle attacks where attackers can intercept, decrypt, and modify network traffic. Affected organizations include industrial facilities, utilities, and any environment using these specific switch models.
💻 Affected Systems
- Korenix JetNet5018G
- Korenix JetNet5310G
- Korenix JetNet5428G-2G-2FX
- Korenix JetNet5628G-R
- Korenix JetNet5628G
- Korenix JetNet5728G-24P
- Korenix JetNet5828G
- Korenix JetNet6710G-HVDC
- Korenix JetNet6710G
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete network compromise where attackers intercept all encrypted traffic, inject malicious commands, disrupt industrial operations, and potentially cause physical damage or safety incidents.
Likely Case
Network traffic interception allowing credential theft, data exfiltration, and unauthorized access to industrial control systems.
If Mitigated
Limited impact if switches are isolated in protected networks with strict access controls and network segmentation.
🎯 Exploit Status
Exploitation requires network access to the switch but no authentication. Attackers can extract keys from firmware or intercept traffic using known certificates.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Contact Korenix for updated firmware versions
Vendor Advisory: https://ics-cert.us-cert.gov/advisories/ICSA-17-299-01
Restart Required: Yes
Instructions:
1. Contact Korenix technical support for updated firmware. 2. Download the firmware update for your specific model. 3. Backup current configuration. 4. Upload and install new firmware via web interface or console. 5. Reboot the switch. 6. Verify firmware version and regenerate certificates.
🔧 Temporary Workarounds
Network Segmentation
allIsolate affected switches in separate VLANs with strict firewall rules to limit attack surface.
Traffic Monitoring
allImplement network monitoring and IDS/IPS to detect man-in-the-middle attempts and certificate anomalies.
🧯 If You Can't Patch
- Replace affected switches with non-vulnerable models
- Implement strict network access controls and monitor all traffic to/from affected switches
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface (System > Firmware) or console command 'show version'. Compare against affected versions list.Check Version:
show version (console) or check System > Firmware in web interfaceVerify Fix Applied:
Verify firmware version is updated beyond affected versions and check that new certificates are generated (not the hard-coded ones).📡 Detection & Monitoring
Log Indicators:
- Certificate validation failures
- Unexpected certificate changes
- Multiple SSL/TLS handshake failures
Network Indicators:
- SSL/TLS traffic interception attempts
- Certificate mismatches in network traffic
- Unexpected certificate authorities
SIEM Query:
ssl.certificate.issuer:"Korenix" OR ssl.certificate.serial_number IN [hard-coded serials from advisory]