CVE-2023-38378
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on RIGOL MSO5000 digital oscilloscopes by injecting shell metacharacters into password change requests. Attackers can gain full control of the device without authentication. Only users of specific RIGOL oscilloscope models with vulnerable firmware are affected.
💻 Affected Systems
- RIGOL MSO5000 digital oscilloscope
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the oscilloscope allowing attackers to modify measurements, exfiltrate sensitive data, or use the device as a pivot point into connected networks.
Likely Case
Unauthorized access to oscilloscope functions, potential data manipulation, and device instability affecting measurement accuracy.
If Mitigated
Limited to internal network access with proper segmentation, reducing exposure to trusted users only.
🎯 Exploit Status
Exploit requires network access to the web interface. No authentication needed for the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None found
Restart Required: No
Instructions:
No official patch available. Check RIGOL website for firmware updates. If update exists: 1. Download firmware from official source 2. Transfer to oscilloscope via USB 3. Follow device update procedure
🔧 Temporary Workarounds
Disable Web Interface
allTurn off the web interface to prevent remote exploitation
Access device settings menu
Navigate to Network/Web settings
Disable web server/interface
Network Segmentation
allIsolate oscilloscope on separate VLAN with strict access controls
🧯 If You Can't Patch
- Disconnect device from network entirely and use local interface only
- Implement strict firewall rules allowing only trusted IP addresses to access the web interface
🔍 How to Verify
Check if Vulnerable:
Check firmware version in device settings. If version is 00.01.03.00.03 and web interface is enabled, device is vulnerable.Check Version:
Check via device menu: System → System Info → Firmware VersionVerify Fix Applied:
Verify firmware version has been updated to a version later than 00.01.03.00.03 or web interface is disabled.📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP requests to /webcontrol/changepwd.cgi
- Failed authentication attempts with shell metacharacters in parameters
Network Indicators:
- HTTP POST requests to changepwd.cgi containing special characters like ;, |, &, or $
- Unexpected outbound connections from oscilloscope
SIEM Query:
source="oscilloscope" AND (url="*changepwd.cgi*" AND (param="*;*" OR param="*|*" OR param="*&*" OR param="*$*"))