CVE-2023-33277
📋 TL;DR
This vulnerability allows remote attackers to read sensitive files on Gira KNX/IP-Router devices via directory traversal attacks in the web interface URL. Attackers can access files outside the intended directory, potentially exposing configuration files, credentials, or system information. Affected systems include Gira KNX/IP-Router versions 3.1.3683.0 and 3.3.8.0.
💻 Affected Systems
- Gira Giersiepen Gira KNX/IP-Router
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through credential theft from configuration files, followed by lateral movement in building automation networks.
Likely Case
Exposure of sensitive configuration data, KNX credentials, and network information that could enable further attacks.
If Mitigated
Limited to information disclosure if proper network segmentation and access controls are implemented.
🎯 Exploit Status
Simple directory traversal sequences in URLs; no authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check with vendor for updated firmware
Vendor Advisory: https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-015.txt
Restart Required: Yes
Instructions:
1. Contact Gira support for patched firmware. 2. Backup configuration. 3. Upload new firmware via web interface. 4. Reboot device. 5. Verify fix by testing directory traversal.
🔧 Temporary Workarounds
Network Segmentation
allIsolate KNX/IP-Router from untrusted networks
Access Control Lists
linuxRestrict web interface access to trusted IPs only
iptables -A INPUT -p tcp --dport 80 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Disable web interface if not required for operations
- Implement strict network segmentation and firewall rules to limit access
🔍 How to Verify
Check if Vulnerable:
Attempt to access /../../etc/passwd or similar traversal patterns via web interfaceCheck Version:
Check firmware version in web interface under System InformationVerify Fix Applied:
Test same directory traversal attempts; should return 404 or access denied📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing ../ patterns
- Access to unusual file paths in web logs
Network Indicators:
- Multiple failed attempts to access sensitive file paths
- Unusual traffic patterns to KNX router web interface
SIEM Query:
source="web_logs" AND (url="*../*" OR url="*..\\*" OR url="*%2e%2e%2f*")