CVE-2020-10634
📋 TL;DR
This vulnerability in SAE IT-systems FW-50 Remote Telemetry Units allows attackers to access sensitive files through directory traversal attacks. Organizations using these industrial control system devices for remote monitoring are affected, potentially exposing configuration files and operational data.
💻 Affected Systems
- SAE IT-systems FW-50 Remote Telemetry Unit
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the RTU allowing attackers to modify configurations, disrupt operations, and potentially pivot to other industrial control systems.
Likely Case
Unauthorized access to sensitive configuration files, passwords, and operational data leading to information disclosure and potential operational disruption.
If Mitigated
Limited impact with proper network segmentation and access controls preventing external exploitation.
🎯 Exploit Status
Directory traversal attacks are well-understood and easy to automate.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Contact vendor for specific firmware version
Vendor Advisory: https://www.us-cert.gov/ics/advisories/ICSA2012602
Restart Required: Yes
Instructions:
1. Contact SAE IT-systems for updated firmware
2. Backup current configuration
3. Apply firmware update following vendor instructions
4. Verify functionality post-update
🔧 Temporary Workarounds
Network Segmentation
allIsolate RTU devices in separate network segments with strict firewall rules
Access Control Lists
allImplement strict IP-based access controls to RTU web interfaces
🧯 If You Can't Patch
- Implement strict network segmentation and firewall rules to block all external access to RTU web interfaces
- Monitor network traffic for directory traversal patterns and unauthorized access attempts
🔍 How to Verify
Check if Vulnerable:
Test web interface with directory traversal payloads (e.g., ../../etc/passwd) or check firmware version against vendor advisoryCheck Version:
Check web interface or device management console for firmware version informationVerify Fix Applied:
Verify firmware version matches vendor's patched version and retest with directory traversal payloads📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing ../ patterns
- Unauthorized file access attempts
- Multiple failed access attempts to sensitive paths
Network Indicators:
- HTTP requests with directory traversal sequences
- Unusual file access patterns from external IPs
SIEM Query:
source="web_logs" AND (uri="*../*" OR uri="*..\\*" OR uri="*%2e%2e%2f*")