CVE-2020-27488
📋 TL;DR
Loxone Miniserver devices with vulnerable firmware cannot properly authenticate with cloud services, allowing attackers to spoof devices and potentially maintain unauthorized access indefinitely. This affects all Loxone Miniserver devices running firmware versions before 11.1 (specifically before 11.1.9.3).
💻 Affected Systems
- Loxone Miniserver
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could permanently spoof legitimate devices, gaining unauthorized access to cloud services, potentially leading to data theft, device manipulation, or persistent backdoor access to home/building automation systems.
Likely Case
Attackers could impersonate legitimate devices to access cloud services, potentially intercepting or manipulating automation commands, though impact depends on specific cloud service functionality.
If Mitigated
With proper firmware updates, devices authenticate properly and spoofing becomes impossible, limiting impact to temporary unauthorized access until authentication occurs.
🎯 Exploit Status
Exploitation requires understanding of the cloud service protocol but doesn't require authentication to the device itself.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware 11.1 (specifically 11.1.9.3 or later)
Vendor Advisory: https://www.loxone.com/enen/security-cloud-dns/
Restart Required: Yes
Instructions:
1. Access Miniserver web interface
2. Navigate to System Settings > Update
3. Check for and install firmware version 11.1.9.3 or later
4. Device will restart automatically after update
🔧 Temporary Workarounds
Disable cloud services temporarily
allDisable cloud connectivity until firmware can be updated
Access Miniserver web interface > System Settings > Cloud Services > Disable
🧯 If You Can't Patch
- Segment Miniserver devices on isolated network segments
- Implement strict firewall rules limiting cloud service communication to known legitimate endpoints only
🔍 How to Verify
Check if Vulnerable:
Check firmware version in Miniserver web interface under System Settings > InformationCheck Version:
Not applicable - check via web interfaceVerify Fix Applied:
Verify firmware version is 11.1.9.3 or later and that cloud authentication is functioning properly📡 Detection & Monitoring
Log Indicators:
- Multiple authentication failures from same device
- Cloud service connections from unexpected IP addresses
Network Indicators:
- Unusual cloud service traffic patterns
- Suspicious DNS queries related to Loxone cloud services
SIEM Query:
source="loxone_miniserver" AND (event_type="auth_failure" OR cloud_connection="unexpected")🔗 References
- https://iot-lab-fh-ooe.github.io/loxone_clouddns_schwachstelle/
- https://iot-lab-fh-ooe.github.io/loxone_clouddns_vulnerability/
- https://www.loxone.com/dede/sicherheit-cloud-dns/
- https://www.loxone.com/enen/security-cloud-dns/
- https://iot-lab-fh-ooe.github.io/loxone_clouddns_schwachstelle/
- https://iot-lab-fh-ooe.github.io/loxone_clouddns_vulnerability/
- https://www.loxone.com/dede/sicherheit-cloud-dns/
- https://www.loxone.com/enen/security-cloud-dns/
