CVE-2023-23551
📋 TL;DR
Control By Web X-600M devices are vulnerable to Lua code injection, allowing remote attackers to execute arbitrary code on affected devices. This affects organizations using these industrial control system devices for remote monitoring and control applications.
💻 Affected Systems
- Control By Web X-600M
📦 What is this software?
X 600m Firmware by Controlbyweb
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attacker to modify control logic, disrupt operations, pivot to other network segments, or cause physical damage in industrial environments.
Likely Case
Remote code execution leading to device takeover, data exfiltration, or disruption of monitoring/control functions.
If Mitigated
Limited impact if devices are isolated in segmented networks with strict access controls and monitoring.
🎯 Exploit Status
Exploitation requires network access to the device's web interface. No authentication is required for the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware version 1.5.0
Vendor Advisory: https://www.controlbyweb.com/support/security-advisory.html
Restart Required: Yes
Instructions:
1. Download firmware 1.5.0 from Control By Web website. 2. Access device web interface. 3. Navigate to System > Firmware Update. 4. Upload new firmware file. 5. Wait for update to complete and device to reboot.
🔧 Temporary Workarounds
Network Segmentation
allIsolate X-600M devices in separate VLANs with strict firewall rules limiting access to authorized management stations only.
Access Control Lists
allImplement IP-based access restrictions on network devices to block unauthorized access to X-600M web interfaces.
🧯 If You Can't Patch
- Disable remote Lua script execution if not required for functionality
- Implement network monitoring for suspicious traffic to/from X-600M devices
🔍 How to Verify
Check if Vulnerable:
Check firmware version in web interface under System > Status. If version is below 1.5.0, device is vulnerable.Check Version:
No CLI command - check via web interface at http://[device-ip]/statusVerify Fix Applied:
Confirm firmware version shows 1.5.0 or higher in System > Status page after update.📡 Detection & Monitoring
Log Indicators:
- Unusual Lua script execution patterns
- Multiple failed login attempts followed by script uploads
- Unexpected firmware update attempts
Network Indicators:
- HTTP POST requests to Lua script endpoints from unauthorized IPs
- Unusual outbound connections from X-600M devices
SIEM Query:
source="X-600M" AND (http_method="POST" AND uri="/lua/*") OR (event="firmware_update")