CVE-2022-35911
📋 TL;DR
CVE-2022-35911 is a buffer overflow vulnerability in Patlite NH-FB series devices that allows remote attackers to cause denial of service by sending requests with omitted query strings. This affects organizations using Patlite NH-FB series network indicators for industrial signaling. The vendor disputes the vulnerability's existence, creating uncertainty for users.
💻 Affected Systems
- Patlite NH-FB series network indicators
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise and potential lateral movement in industrial networks
Likely Case
Denial of service causing Patlite indicators to become unresponsive, disrupting industrial signaling operations
If Mitigated
Minimal impact if devices are properly segmented and network access is restricted
🎯 Exploit Status
Exploit requires sending malformed HTTP requests with omitted query strings
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown - vendor disputes vulnerability
Vendor Advisory: https://www.patlite.co.jp/product/detail0000021462.html
Restart Required: No
Instructions:
Contact Patlite support for guidance since vendor disputes vulnerability existence
🔧 Temporary Workarounds
Network segmentation
allIsolate Patlite devices in separate VLAN with strict firewall rules
Access control lists
allRestrict network access to Patlite devices to authorized IP addresses only
🧯 If You Can't Patch
- Deploy network monitoring to detect abnormal HTTP traffic to Patlite devices
- Implement redundant signaling systems to maintain operations if devices become unavailable
🔍 How to Verify
Check if Vulnerable:
Check device firmware version via web interface or serial consoleCheck Version:
Check device web interface at http://[device-ip]/ or use serial console connectionVerify Fix Applied:
No official fix available - monitor for vendor updates📡 Detection & Monitoring
Log Indicators:
- HTTP requests with missing query strings to Patlite devices
- Device reboot or unresponsive logs
Network Indicators:
- Abnormal HTTP traffic patterns to Patlite device ports
- Increased connection attempts to port 80
SIEM Query:
source_ip="*" AND dest_ip="patlite_device" AND http_request CONTAINS "?" AND http_request NOT CONTAINS "query="🔗 References
- https://packetstormsecurity.com/files/167797/Patlite-1.46-Buffer-Overflow.html
- https://www.patlite.co.jp/product/detail0000021462.html
- https://www.patlite.com/network-products/lineup/nh-fb.html
- https://packetstormsecurity.com/files/167797/Patlite-1.46-Buffer-Overflow.html
- https://www.patlite.co.jp/product/detail0000021462.html
- https://www.patlite.com/network-products/lineup/nh-fb.html
