CVE-2021-22667
📋 TL;DR
This vulnerability affects BB-ESWGP506-2SFP-T industrial switches with hard-coded credentials, allowing attackers to gain unauthorized access and execute arbitrary code. Affected versions are 1.01.09 and prior, with versions 1.01.01 and prior specifically vulnerable to code execution. Organizations using these switches in industrial control systems are at risk.
💻 Affected Systems
- BB-ESWGP506-2SFP-T industrial Ethernet switch
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of industrial network, unauthorized control of connected devices, data exfiltration, and potential physical damage to industrial processes.
Likely Case
Unauthorized access to switch configuration, network disruption, lateral movement within industrial network, and potential data theft.
If Mitigated
Limited impact if switches are isolated in segmented networks with strict access controls and monitoring.
🎯 Exploit Status
Exploitation requires only knowledge of hard-coded credentials and network access to the switch. No authentication bypass needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 1.01.10 or later
Vendor Advisory: https://us-cert.cisa.gov/ics/advisories/icsa-21-054-02
Restart Required: Yes
Instructions:
1. Download firmware version 1.01.10 or later from vendor. 2. Backup current configuration. 3. Upload new firmware via web interface. 4. Reboot switch. 5. Verify firmware version and change all credentials.
🔧 Temporary Workarounds
Network segmentation and isolation
allIsolate affected switches in separate VLANs with strict firewall rules to limit access.
Disable web interface if not needed
allDisable HTTP/HTTPS management interface and use console or SSH only if supported.
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach the switch management interface
- Monitor for authentication attempts and unusual configuration changes on affected switches
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface (System > System Information) or console. Versions 1.01.09 and prior are vulnerable.Check Version:
Via web interface: System > System Information. Via console: show versionVerify Fix Applied:
Verify firmware version is 1.01.10 or later and test that hard-coded credentials no longer work.📡 Detection & Monitoring
Log Indicators:
- Failed login attempts with default credentials
- Successful logins from unexpected IPs
- Configuration changes from unauthorized users
Network Indicators:
- HTTP/HTTPS traffic to switch management interface from unusual sources
- Unusual outbound connections from switch
SIEM Query:
source="switch_logs" AND (event_type="authentication" AND (username="admin" OR username="root")) OR (event_type="configuration_change")