CVE-2022-29735
📋 TL;DR
Delta Controls enteliTOUCH building automation controllers have a cross-site request forgery (CSRF) vulnerability that allows attackers to execute arbitrary commands via crafted HTTP requests. This affects enteliTOUCH versions 3.40.3935, 3.40.3706, and 3.33.4005. Attackers can potentially take full control of affected building automation systems.
💻 Affected Systems
- Delta Controls enteliTOUCH
📦 What is this software?
Entelitouch Firmware by Deltacontrols
Entelitouch Firmware by Deltacontrols
Entelitouch Firmware by Deltacontrols
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to execute arbitrary commands, manipulate building controls, disable security systems, or pivot to other network systems.
Likely Case
Unauthorized command execution leading to building system manipulation, data theft, or service disruption.
If Mitigated
Limited impact with proper network segmentation and access controls preventing exploitation attempts.
🎯 Exploit Status
Crafted HTTP requests can trigger command execution without authentication. Public vulnerability details available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check with Delta Controls for updated firmware
Vendor Advisory: https://www.deltacontrols.com/
Restart Required: Yes
Instructions:
1. Contact Delta Controls support for patched firmware. 2. Backup current configuration. 3. Apply firmware update via management interface. 4. Restart device. 5. Verify functionality.
🔧 Temporary Workarounds
Network Segmentation
allIsolate enteliTOUCH devices on separate VLANs with strict firewall rules.
Access Control
allImplement strict network access controls to limit HTTP access to authorized IPs only.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate enteliTOUCH devices from untrusted networks
- Deploy web application firewall (WAF) with CSRF protection rules in front of devices
🔍 How to Verify
Check if Vulnerable:
Check device firmware version via web interface or management console. If version matches affected list, device is vulnerable.Check Version:
Check via web interface at http://[device-ip]/ or through management softwareVerify Fix Applied:
Verify firmware version has been updated to a version not listed in affected versions.📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP requests to enteliTOUCH devices
- Multiple failed authentication attempts followed by command execution patterns
Network Indicators:
- HTTP requests with unusual parameters or command injection patterns to enteliTOUCH ports
SIEM Query:
source_ip="*" AND dest_ip="enteliTOUCH_IP" AND (http_method="POST" OR http_method="GET") AND (url_contains="command" OR url_contains="exec")