CVE-2021-28911
📋 TL;DR
Unauthenticated attackers can access the /tmp directory in BAB TECHNOLOGIE GmbH eibPort V3 devices prior to version 3.9.1, exposing sensitive data like device serial numbers. This information enables brute-force attacks against the BMX interface to calculate login credentials, potentially leading to SSH root access. This affects all eibPort V3 installations running versions before 3.9.1.
💻 Affected Systems
- BAB TECHNOLOGIE GmbH eibPort V3
📦 What is this software?
Eibport Firmware by Bab Technologie
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain SSH root access to the device, enabling complete system compromise, data theft, and potential lateral movement within the network.
Likely Case
Attackers obtain device serial numbers and brute-force BMX interface credentials, gaining administrative access to the device management interface.
If Mitigated
With proper access controls and network segmentation, attackers cannot reach the vulnerable interface, limiting impact to isolated systems.
🎯 Exploit Status
Exploitation requires only HTTP access to the device and basic scripting for brute-force attacks.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.9.1
Vendor Advisory: https://psytester.github.io/CVE-2021-28911
Restart Required: Yes
Instructions:
1. Download eibPort V3 version 3.9.1 or later from the vendor. 2. Backup current configuration. 3. Apply the firmware update through the device management interface. 4. Reboot the device. 5. Verify the update was successful.
🔧 Temporary Workarounds
Restrict Network Access
linuxBlock all external access to eibPort devices using firewall rules.
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
Remove /tmp Directory Access
linuxChange permissions on the /tmp directory to prevent unauthorized access.
chmod 700 /tmp
🧯 If You Can't Patch
- Isolate eibPort devices on a separate VLAN with strict access controls.
- Implement network monitoring for unusual access patterns to the device management interface.
🔍 How to Verify
Check if Vulnerable:
Check if accessing http://<device_ip>/tmp returns directory listing or sensitive files.Check Version:
Check device web interface or use command: cat /etc/version | grep eibPortVerify Fix Applied:
Verify that accessing /tmp path returns 403 Forbidden or similar error after patching.📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts to BMX interface
- Unauthorized access to /tmp directory in web server logs
Network Indicators:
- Unusual HTTP requests to /tmp path
- Brute-force patterns against device management interface
SIEM Query:
source="web_logs" AND (uri="/tmp" OR uri="/tmp/*")