CVE-2023-36623
📋 TL;DR
This vulnerability allows local attackers to calculate the root password of Loxone Miniserver Go Gen.2 devices using hard-coded secrets and the device's MAC address. This enables privilege escalation to root access. Affected users are those running vulnerable versions of this smart home server.
💻 Affected Systems
- Loxone Miniserver Go Gen.2
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the smart home server, allowing attackers to gain persistent root access, modify device configurations, access sensitive home automation data, and potentially pivot to other network devices.
Likely Case
Local attackers with physical or network access can gain root privileges, potentially disrupting smart home operations, accessing camera feeds, or manipulating automation rules.
If Mitigated
With proper network segmentation and access controls, impact is limited to the device itself, preventing lateral movement to other systems.
🎯 Exploit Status
Exploitation requires local network access but no authentication. The password calculation algorithm has been publicly documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 14.2
Vendor Advisory: https://www.loxone.com/enen/kb/cve-2023-36623/
Restart Required: Yes
Instructions:
1. Log into Loxone Config interface. 2. Navigate to System Updates. 3. Update to version 14.2 or later. 4. Reboot the device after update completes.
🔧 Temporary Workarounds
Network Segmentation
allIsolate Loxone Miniserver on separate VLAN to limit local access
Change Root Password
linuxManually change root password if device cannot be immediately updated
ssh root@miniserver-ip
passwd
🧯 If You Can't Patch
- Segment the device on a dedicated network VLAN with strict access controls
- Implement network monitoring for unauthorized access attempts to the device
🔍 How to Verify
Check if Vulnerable:
Check device version in Loxone Config interface. If version is below 14.2, device is vulnerable.Check Version:
Connect to Loxone Config interface and check System InformationVerify Fix Applied:
Verify version is 14.2 or higher in Loxone Config interface. Test that root password cannot be calculated using MAC address.📡 Detection & Monitoring
Log Indicators:
- Multiple failed SSH login attempts followed by successful root login
- Unusual root access patterns
Network Indicators:
- SSH connections to device from unexpected internal IPs
- Port scanning activity targeting the device
SIEM Query:
source="loxone.logs" AND (event="ssh_login" AND user="root") OR (event="port_scan" AND target_ip="loxone_device_ip")🔗 References
- https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-013.txt
- https://www.syss.de/pentest-blog/root-zugang-zu-smarthome-server-loxone-miniserver-go-gen-2-syss-2023-004/-012/-013
- https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-013.txt
- https://www.syss.de/pentest-blog/root-zugang-zu-smarthome-server-loxone-miniserver-go-gen-2-syss-2023-004/-012/-013
