CVE-2021-42833
📋 TL;DR
AquaView versions 1.60, 7.x, and 8.x contain hardcoded credentials that allow authenticated local attackers to manipulate users and system settings. This vulnerability affects water management systems using these specific software versions. Attackers with local access can exploit these credentials to gain unauthorized control.
💻 Affected Systems
- AquaView
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to modify critical water management settings, create backdoor accounts, disrupt operations, or cause physical damage to infrastructure.
Likely Case
Unauthorized access leading to configuration changes, user account manipulation, and potential data exfiltration from affected systems.
If Mitigated
Limited impact with proper network segmentation, access controls, and monitoring preventing credential use even if discovered.
🎯 Exploit Status
Exploitation requires authenticated local access but is straightforward once credentials are discovered. No public exploit code available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 5.0 and later
Vendor Advisory: https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xpsa-aquaview-v5.0.pdf
Restart Required: Yes
Instructions:
1. Download AquaView version 5.0 or later from Xylem. 2. Backup current configuration. 3. Install the updated version following vendor instructions. 4. Restart the system. 5. Verify the update was successful.
🔧 Temporary Workarounds
Network Segmentation
allIsolate AquaView systems from general network access to limit attack surface
Access Control Hardening
allImplement strict access controls and monitoring for local system access
🧯 If You Can't Patch
- Implement strict network segmentation to isolate AquaView systems from untrusted networks
- Enhance monitoring and logging for authentication attempts and configuration changes
🔍 How to Verify
Check if Vulnerable:
Check AquaView version in system settings or about dialog. Versions 1.60, 7.x, or 8.x are vulnerable.Check Version:
Check AquaView application menu → Help → About or system configuration interfaceVerify Fix Applied:
Verify AquaView version is 5.0 or later. Check vendor documentation for specific fix verification steps.📡 Detection & Monitoring
Log Indicators:
- Unusual authentication attempts
- Configuration changes from unexpected users
- Multiple failed login attempts followed by success
Network Indicators:
- Unexpected connections to AquaView systems
- Traffic patterns indicating configuration changes
SIEM Query:
source="aquaview" AND (event_type="authentication" OR event_type="configuration_change")🔗 References
- https://www.cisa.gov/uscert/ics/advisories/icsa-21-350-01
- https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xpsa-aquaview-v5.0.pdf
- https://www.cisa.gov/uscert/ics/advisories/icsa-21-350-01
- https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xpsa-aquaview-v5.0.pdf
