CVE-2023-46383
📋 TL;DR
LOYTEC LINX Configurator transmits authentication credentials in base64-encoded cleartext over HTTP, allowing attackers to intercept and decode usernames and passwords. This affects all versions of LOYTEC LINX Configurator software used for building automation device configuration.
💻 Affected Systems
- LOYTEC electronics GmbH LINX Configurator
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain full administrative control over building automation systems, potentially manipulating HVAC, lighting, security systems, or causing physical damage.
Likely Case
Attackers steal credentials and gain unauthorized access to device configurations, potentially modifying settings or deploying malicious configurations.
If Mitigated
Attackers can intercept credentials but cannot use them due to network segmentation, strong authentication requirements, or credential rotation.
🎯 Exploit Status
Exploitation requires network access to intercept HTTP traffic. Attackers need to capture authentication traffic between client and server.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: None available
Vendor Advisory: https://www.cisa.gov/news-events/ics-advisories/icsa-24-247-01
Restart Required: No
Instructions:
No official patch available. Follow workarounds and mitigation steps below.
🔧 Temporary Workarounds
Enforce HTTPS/TLS
allConfigure the LINX Configurator to use HTTPS with valid certificates instead of HTTP
Network Segmentation
allIsolate LOYTEC configuration traffic to dedicated VLANs or network segments
🧯 If You Can't Patch
- Deploy network encryption via VPN tunnels for all LOYTEC configuration traffic
- Implement strict network access controls and monitor for credential interception attempts
🔍 How to Verify
Check if Vulnerable:
Use network monitoring tools to capture traffic between LINX Configurator client and server. Check if authentication occurs over HTTP with base64-encoded Authorization headers.Check Version:
Check software version in LINX Configurator About dialog or installation directoryVerify Fix Applied:
Verify all configuration traffic uses HTTPS/TLS with valid certificates and no HTTP Basic Authentication headers are transmitted in cleartext.📡 Detection & Monitoring
Log Indicators:
- Failed authentication attempts from unexpected IPs
- Configuration changes from unauthorized users
Network Indicators:
- HTTP traffic with base64-encoded Authorization headers to LOYTEC configuration ports
- Unencrypted authentication traffic on network
SIEM Query:
source_ip=* AND dest_port IN (80, 8080) AND http_method=POST AND http_uri CONTAINS "config" AND http_header CONTAINS "Authorization: Basic"🔗 References
- https://packetstormsecurity.com/files/175951/Loytec-LINX-Configurator-7.4.10-Insecure-Transit-Cleartext-Secrets.html
- https://seclists.org/fulldisclosure/2023/Nov/6
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-247-01
- https://www.txone.com/blog/ten-unpatched-vulnerabilities-in-building-automation-products-identified-by-txone-networks/
- http://seclists.org/fulldisclosure/2023/Nov/6
- https://packetstormsecurity.com/files/175951/Loytec-LINX-Configurator-7.4.10-Insecure-Transit-Cleartext-Secrets.html
- https://seclists.org/fulldisclosure/2023/Nov/6
- https://www.txone.com/blog/ten-unpatched-vulnerabilities-in-building-automation-products-identified-by-txone-networks/
