CVE-2023-0354
📋 TL;DR
The Akuvox E11 web server lacks authentication controls, allowing unauthenticated attackers to access sensitive information and create/download packet captures via default URLs. This affects organizations using Akuvox E11 devices, particularly in industrial control systems and physical security deployments.
💻 Affected Systems
- Akuvox E11
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of device, unauthorized access to sensitive network traffic via packet captures, potential lateral movement into connected systems, and disruption of physical security operations.
Likely Case
Unauthorized access to device configuration, sensitive information disclosure, and network reconnaissance through packet capture analysis.
If Mitigated
Limited impact if device is isolated in protected network segments with strict access controls and monitoring.
🎯 Exploit Status
Exploitation requires only web access to device with known default URLs.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor for specific patched version
Vendor Advisory: https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-01
Restart Required: Yes
Instructions:
1. Contact Akuvox for firmware updates. 2. Download latest firmware. 3. Apply update via web interface. 4. Reboot device. 5. Verify authentication is required.
🔧 Temporary Workarounds
Network Segmentation
allIsolate Akuvox E11 devices in protected network segments with strict firewall rules.
Access Control Lists
allImplement strict IP-based access controls to limit web interface access.
🧯 If You Can't Patch
- Disable web interface if not required for operations
- Implement network monitoring for unauthorized access attempts to device URLs
🔍 How to Verify
Check if Vulnerable:
Attempt to access device web interface without authentication using browser or curl command.Check Version:
Check firmware version in device web interface or contact vendor.Verify Fix Applied:
Verify authentication prompt appears when accessing web interface and default URLs require credentials.📡 Detection & Monitoring
Log Indicators:
- Unauthenticated access to web interface
- Access to packet capture URLs without authentication
Network Indicators:
- HTTP requests to device IP on port 80/443 without authentication headers
- Unusual packet capture file downloads
SIEM Query:
source_ip="device_ip" AND (http_status=200 OR url_contains="pcap") AND NOT auth_present