CVE-2021-27440
📋 TL;DR
The Reason DR60 industrial device contains a hard-coded password that cannot be changed, allowing attackers to gain unauthorized access. This affects all Reason DR60 devices with firmware versions prior to 02A04.1, potentially compromising industrial control systems.
💻 Affected Systems
- Reason DR60
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of industrial control systems, unauthorized access to sensitive industrial networks, potential manipulation of physical processes, and disruption of critical infrastructure operations.
Likely Case
Unauthorized access to the DR60 device, network reconnaissance, credential theft, and lateral movement within industrial networks.
If Mitigated
Limited impact if device is isolated in segmented networks with strict access controls and monitoring.
🎯 Exploit Status
Exploitation requires only knowledge of the hard-coded password and network access to the device.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 02A04.1
Vendor Advisory: https://us-cert.cisa.gov/ics/advisories/icsa-21-082-03
Restart Required: Yes
Instructions:
1. Download firmware version 02A04.1 from Reason official sources. 2. Follow Reason's firmware update procedure for DR60 devices. 3. Verify successful update and restart device.
🔧 Temporary Workarounds
Network Segmentation
allIsolate DR60 devices in separate network segments with strict firewall rules
Access Control Lists
allImplement strict network access controls to limit connections to DR60 devices
🧯 If You Can't Patch
- Segment DR60 devices in isolated VLANs with strict firewall rules
- Implement network monitoring and intrusion detection for unauthorized access attempts
- Disable unnecessary services and ports on DR60 devices
🔍 How to Verify
Check if Vulnerable:
Check firmware version on DR60 device web interface or console. If version is below 02A04.1, device is vulnerable.Check Version:
Check device web interface at System > Firmware or use console commands specific to DR60Verify Fix Applied:
Verify firmware version shows 02A04.1 or higher in device interface.📡 Detection & Monitoring
Log Indicators:
- Failed authentication attempts followed by successful login
- Unauthorized access from unexpected IP addresses
- Configuration changes from unknown users
Network Indicators:
- Unexpected connections to DR60 management ports
- Traffic patterns indicating reconnaissance
- Authentication attempts using default credentials
SIEM Query:
source="DR60" AND (event_type="authentication" AND result="success") AND user="default"