CVE-2021-21960
📋 TL;DR
A critical stack-based buffer overflow vulnerability in Sealevel Systems SeaConnect 370W's LLMNR functionality allows remote attackers to execute arbitrary code by sending specially crafted network packets. This affects all systems running the vulnerable firmware version, potentially giving attackers full control over affected devices.
💻 Affected Systems
- Sealevel Systems SeaConnect 370W
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with remote code execution leading to device takeover, lateral movement, and persistent access to industrial control networks.
Likely Case
Remote code execution allowing attackers to install malware, disrupt operations, or use device as pivot point for further attacks.
If Mitigated
Limited impact if device is isolated behind firewalls with strict network segmentation and packet filtering.
🎯 Exploit Status
Public exploit details available in Talos Intelligence reports. Attack requires network access to device.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v1.3.35 or later
Vendor Advisory: https://www.sealevel.com/support/security-advisory/
Restart Required: Yes
Instructions:
1. Download latest firmware from Sealevel support portal. 2. Backup current configuration. 3. Upload new firmware via web interface. 4. Reboot device. 5. Verify firmware version.
🔧 Temporary Workarounds
Disable LLMNR
allDisable Link-Local Multicast Name Resolution functionality if not required.
Configuration via web interface: Network Settings → Advanced → Disable LLMNR
Network Segmentation
allIsolate SeaConnect devices in separate VLAN with strict firewall rules.
🧯 If You Can't Patch
- Implement strict network access controls allowing only trusted IPs to communicate with SeaConnect devices.
- Deploy intrusion detection systems to monitor for exploit attempts and anomalous network traffic.
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface: System → About → Firmware VersionCheck Version:
curl -s http://device-ip/api/system/info | grep firmware_versionVerify Fix Applied:
Verify firmware version is v1.3.35 or later and test LLMNR functionality is either patched or disabled.📡 Detection & Monitoring
Log Indicators:
- Multiple malformed LLMNR packets
- System crash/restart logs
- Unusual process creation
Network Indicators:
- Unusual LLMNR traffic to SeaConnect devices
- Large or malformed LLMNR packets
- Traffic from unexpected sources
SIEM Query:
source="firewall" AND dest_ip="seaconnect_device" AND (protocol="udp" AND port=5355) AND packet_size>512