CVE-2023-46385
📋 TL;DR
LOYTEC LINX Configurator transmits admin credentials as unencrypted URL parameters, allowing attackers to intercept and steal passwords. This vulnerability affects all versions of LOYTEC electronics GmbH LINX Configurator software, enabling full control of Loytec device configurations.
💻 Affected Systems
- LOYTEC electronics GmbH LINX Configurator
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain administrative access to building automation systems, allowing them to modify configurations, disrupt operations, or cause physical damage to connected devices.
Likely Case
Credential theft leading to unauthorized access to Loytec device configurations, potentially enabling manipulation of building automation systems.
If Mitigated
Limited impact if network segmentation prevents external access and credential rotation is implemented after potential exposure.
🎯 Exploit Status
Exploitation requires network access to intercept traffic or access to URL history/logs containing credentials.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: None available
Vendor Advisory: https://www.cisa.gov/news-events/ics-advisories/icsa-24-247-01
Restart Required: No
Instructions:
No official patch available. Follow workarounds and mitigation steps below.
🔧 Temporary Workarounds
Network Segmentation
allIsolate LINX Configurator systems from untrusted networks and internet access.
Credential Rotation
allChange all admin passwords used with LINX Configurator immediately.
🧯 If You Can't Patch
- Implement strict network access controls to prevent external access to LINX Configurator instances
- Monitor network traffic for URL parameters containing credential strings and implement credential rotation policies
🔍 How to Verify
Check if Vulnerable:
Check if LINX Configurator transmits credentials as URL parameters by examining network traffic or application logs.Check Version:
Check version in LINX Configurator application interface or installation directory.Verify Fix Applied:
Verify no credentials appear in URL parameters during authentication by monitoring network traffic.📡 Detection & Monitoring
Log Indicators:
- URL parameters containing 'password', 'admin', or credential-like strings in web server or application logs
Network Indicators:
- HTTP/HTTPS traffic containing credential parameters in URLs to LINX Configurator endpoints
SIEM Query:
search 'LINX Configurator' AND (password OR admin) IN url_parameters🔗 References
- https://packetstormsecurity.com/files/175951/Loytec-LINX-Configurator-7.4.10-Insecure-Transit-Cleartext-Secrets.html
- https://seclists.org/fulldisclosure/2023/Nov/6
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-247-01
- https://www.txone.com/blog/ten-unpatched-vulnerabilities-in-building-automation-products-identified-by-txone-networks/
- http://seclists.org/fulldisclosure/2023/Nov/6
- https://packetstormsecurity.com/files/175951/Loytec-LINX-Configurator-7.4.10-Insecure-Transit-Cleartext-Secrets.html
- https://seclists.org/fulldisclosure/2023/Nov/6
- https://www.txone.com/blog/ten-unpatched-vulnerabilities-in-building-automation-products-identified-by-txone-networks/
