CVE-2023-25366
📋 TL;DR
This vulnerability in Siglent SDS oscilloscopes allows attackers to retrieve the web interface password through the insecure SCPI interface. It affects users of Siglent SDS 1104X-E devices running vulnerable firmware, potentially exposing administrative credentials.
💻 Affected Systems
- Siglent SDS 1104X-E
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full device compromise allowing attackers to modify device settings, capture sensitive measurement data, or use the device as a network pivot point.
Likely Case
Unauthorized access to the web interface leading to configuration changes, data theft, or denial of service.
If Mitigated
Limited impact if device is isolated from untrusted networks and SCPI interface is disabled.
🎯 Exploit Status
Simple SCPI command execution to retrieve credentials.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://siglent.com
Restart Required: No
Instructions:
Check Siglent website for firmware updates. If available, download and install via USB or network update.
🔧 Temporary Workarounds
Disable SCPI Interface
allTurn off the SCPI interface if not required for operations.
Navigate to device settings > Interface > SCPI > Disable
Network Segmentation
allIsolate oscilloscope on separate VLAN without internet access.
🧯 If You Can't Patch
- Disable web interface entirely if not needed
- Implement strict firewall rules to block all external access to device
🔍 How to Verify
Check if Vulnerable:
Connect to device via SCPI (port 5025) and send command to retrieve web password.Check Version:
Check device System Info menu or use SCPI command *IDN?Verify Fix Applied:
Attempt same SCPI command; should return error or no password.📡 Detection & Monitoring
Log Indicators:
- Unusual SCPI command patterns
- Multiple failed web login attempts
Network Indicators:
- Unexpected connections to port 5025 (SCPI)
- Traffic to web interface from unusual sources
SIEM Query:
source_port:5025 OR destination_port:5025 | stats count by src_ip