CVE-2023-35120
📋 TL;DR
PiiGAB M-Bus devices are vulnerable to cross-site request forgery (CSRF) attacks. An attacker can trick authenticated users into clicking malicious links that execute unauthorized commands on the device. This affects all PiiGAB M-Bus users with web interface access and stored authentication cookies.
💻 Affected Systems
- PiiGAB M-Bus
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attacker to execute arbitrary commands, modify configurations, disrupt operations, or potentially pivot to other systems.
Likely Case
Unauthorized command execution leading to configuration changes, data manipulation, or service disruption.
If Mitigated
Limited impact with proper CSRF protections and user awareness training.
🎯 Exploit Status
Requires user interaction (clicking malicious link) but trivial to craft exploit
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for specific version
Vendor Advisory: https://www.cisa.gov/news-events/ics-advisories/icsa-23-187-01
Restart Required: Yes
Instructions:
1. Check vendor advisory for patch availability 2. Download latest firmware 3. Backup current configuration 4. Apply firmware update 5. Restart device 6. Verify functionality
🔧 Temporary Workarounds
Implement CSRF Tokens
allAdd anti-CSRF tokens to all state-changing requests
Session Timeout Reduction
allReduce session timeout to minimize window for exploitation
🧯 If You Can't Patch
- Implement network segmentation to isolate M-Bus devices
- Use browser extensions that block CSRF attempts and educate users about phishing risks
🔍 How to Verify
Check if Vulnerable:
Check if web interface lacks CSRF protection tokens on POST/GET requestsCheck Version:
Check web interface admin panel for firmware versionVerify Fix Applied:
Verify CSRF tokens are present and validated on all state-changing requests📡 Detection & Monitoring
Log Indicators:
- Unexpected configuration changes
- Commands executed without corresponding user login events
Network Indicators:
- HTTP requests with referrer headers from external domains
- Unusual command patterns
SIEM Query:
source="m-bus" AND (action="config_change" OR action="command_exec") AND NOT user_agent="browser_session"