CVE-2021-46420
📋 TL;DR
This vulnerability allows unauthenticated attackers to perform directory traversal attacks on Franklin Fueling Systems TS-550 evo devices, potentially accessing sensitive files and system information. It affects systems running version 2.23.4.8936 of the software. Organizations using these fuel management systems are at risk.
💻 Affected Systems
- Franklin Fueling Systems FFS TS-550 evo
📦 What is this software?
Ts 550 Evo Firmware by Franklinfueling
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through access to configuration files, credentials, and sensitive operational data, potentially enabling further attacks on fuel management infrastructure.
Likely Case
Unauthorized access to sensitive configuration files, logs, and system information that could be used for reconnaissance or credential theft.
If Mitigated
Limited information disclosure with no critical system access if proper network segmentation and access controls are implemented.
🎯 Exploit Status
Directory traversal vulnerabilities are commonly exploited with simple HTTP requests; the provided references likely contain proof-of-concept details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not provided in references
Restart Required: No
Instructions:
Contact Franklin Fueling Systems for updated firmware or security patches. Check their official website or support channels for security advisories.
🔧 Temporary Workarounds
Network Segmentation
allIsolate TS-550 evo devices from untrusted networks and restrict access to authorized IPs only.
Web Application Firewall
allDeploy WAF rules to block directory traversal patterns like '../' sequences in HTTP requests.
🧯 If You Can't Patch
- Implement strict network access controls to limit device exposure
- Monitor for unusual file access patterns and directory traversal attempts in logs
🔍 How to Verify
Check if Vulnerable:
Test with directory traversal payloads (e.g., '../../etc/passwd') against the device's web interface if authorized.Check Version:
Check device web interface or console for firmware version informationVerify Fix Applied:
Verify firmware version is updated beyond 2.23.4.8936 and retest traversal attempts.📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing '../' sequences, unusual file access patterns
Network Indicators:
- HTTP requests to unexpected file paths, abnormal traffic to device ports
SIEM Query:
http.url:*../* AND (dst_ip:TS550_IP OR dst_port:DEVICE_PORT)