CVE-2023-35987
📋 TL;DR
PiiGAB M-Bus devices contain hard-coded credentials that allow authentication bypass. This affects all systems using vulnerable PiiGAB M-Bus products, potentially enabling attackers to gain unauthorized access to building automation systems.
💻 Affected Systems
- PiiGAB M-Bus
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of building automation systems allowing attackers to manipulate HVAC, lighting, security systems, or cause physical damage.
Likely Case
Unauthorized access to building management systems enabling data theft, surveillance, or disruption of building operations.
If Mitigated
Limited impact if systems are isolated from networks and have additional authentication layers.
🎯 Exploit Status
Exploitation requires only knowledge of hard-coded credentials and network access to device.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for specific patched versions
Vendor Advisory: https://www.cisa.gov/news-events/ics-advisories/icsa-23-187-01
Restart Required: Yes
Instructions:
1. Contact PiiGAB vendor for patched firmware
2. Backup current configuration
3. Apply firmware update following vendor instructions
4. Restart device
5. Verify new credentials are required for authentication
🔧 Temporary Workarounds
Network Segmentation
allIsolate PiiGAB M-Bus devices from untrusted networks
Access Control Lists
allImplement strict network ACLs to limit access to M-Bus devices
🧯 If You Can't Patch
- Implement network segmentation to isolate vulnerable devices
- Deploy additional authentication mechanisms before M-Bus devices
🔍 How to Verify
Check if Vulnerable:
Attempt authentication using known hard-coded credentials (check CISA advisory for specifics)Check Version:
Check device firmware version via vendor-specific interfaceVerify Fix Applied:
Verify authentication fails with old hard-coded credentials and requires new credentials📡 Detection & Monitoring
Log Indicators:
- Authentication attempts using hard-coded credentials
- Unauthorized access to M-Bus services
Network Indicators:
- Unexpected connections to M-Bus ports (typically 502/TCP)
- Traffic patterns indicating credential brute-forcing
SIEM Query:
source_ip=* AND destination_port=502 AND (authentication_failure OR authentication_success)