CVE-2017-6047
📋 TL;DR
CVE-2017-6047 exposes plaintext passwords in an unauthenticated file on Detcon Sitewatch Gateway devices. This allows attackers to obtain administrative credentials and fully compromise the industrial control system gateway. All versions without cellular connectivity are affected.
💻 Affected Systems
- Detcon Sitewatch Gateway
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover allowing attackers to manipulate industrial processes, disable safety systems, or exfiltrate sensitive industrial data.
Likely Case
Unauthorized access to the gateway leading to configuration changes, monitoring disruption, or credential harvesting for lateral movement.
If Mitigated
Limited impact if proper network segmentation and access controls prevent attackers from reaching the vulnerable file.
🎯 Exploit Status
Exploitation requires only HTTP access to retrieve the password file. No authentication or special tools needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Contact Detcon for updated firmware
Vendor Advisory: https://ics-cert.us-cert.gov/advisories/ICSA-17-136-01
Restart Required: Yes
Instructions:
1. Contact Detcon for updated firmware. 2. Backup current configuration. 3. Apply firmware update following vendor instructions. 4. Verify passwords are no longer stored in plaintext.
🔧 Temporary Workarounds
Network Segmentation
allIsolate Sitewatch Gateway from untrusted networks and restrict access to authorized IPs only.
Access Control Lists
allImplement firewall rules to block all external access to the gateway's web interface.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the gateway from all untrusted networks
- Change all passwords immediately and monitor for unauthorized access attempts
🔍 How to Verify
Check if Vulnerable:
Check if accessible file contains plaintext passwords. Access the gateway's web interface and look for password files.Check Version:
Check firmware version through web interface or contact Detcon supportVerify Fix Applied:
Verify that password files are no longer accessible or contain encrypted/hashed passwords only.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to password files
- Multiple failed login attempts followed by successful login
Network Indicators:
- HTTP requests to known password file locations
- Unusual traffic patterns to/from the gateway
SIEM Query:
source_ip="gateway_ip" AND (url_contains="password" OR url_contains="cred")