CVE-2018-12924
📋 TL;DR
This vulnerability allows attackers to gain unauthorized access to Sollae Serial-Ethernet-Module and Remote-I/O-Device-Server devices via TELNET using the default password 'sollae'. Organizations using these devices with default credentials are affected, potentially exposing industrial control systems to compromise.
💻 Affected Systems
- Sollae Serial-Ethernet-Module
- Sollae Remote-I/O-Device-Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover leading to industrial control system manipulation, data exfiltration, or disruption of critical operations.
Likely Case
Unauthorized access to device configuration, potential lateral movement within industrial networks, and monitoring of serial communications.
If Mitigated
Limited impact if strong authentication is enforced and network segmentation isolates vulnerable devices.
🎯 Exploit Status
Simple telnet connection with default credentials. Widely known in security communities.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: Not publicly available
Restart Required: No
Instructions:
1. Access device via TELNET or web interface
2. Navigate to administration/security settings
3. Change default password to strong, unique credential
4. Document new password securely
🔧 Temporary Workarounds
Disable TELNET service
allCompletely disable TELNET access if not required for operations
Configuration varies by device - check device admin interface
Network access control
linuxRestrict TELNET access to specific management IP addresses
Use firewall rules: iptables -A INPUT -p tcp --dport 23 -s [TRUSTED_IP] -j ACCEPT
iptables -A INPUT -p tcp --dport 23 -j DROP
🧯 If You Can't Patch
- Implement network segmentation to isolate vulnerable devices in separate VLAN
- Deploy network monitoring to detect TELNET authentication attempts
🔍 How to Verify
Check if Vulnerable:
Attempt TELNET connection to device port 23 using username/password combination: sollae/sollaeCheck Version:
Device-specific - typically via web interface or serial consoleVerify Fix Applied:
Attempt TELNET connection with default credentials - should be rejected. Verify new strong password works.📡 Detection & Monitoring
Log Indicators:
- Failed TELNET authentication attempts
- Successful TELNET logins from unusual IPs
Network Indicators:
- TELNET traffic to industrial devices
- Port 23 connections from unauthorized networks
SIEM Query:
source="telnet.log" AND (event="authentication failed" OR event="login successful")