CVE-2023-47579
📋 TL;DR
Relyum RELY-PCIe 22.2.1 devices have a system group misconfiguration that allows unauthorized read access to the operating system's central password hash file. This affects organizations using these specific industrial networking devices, potentially exposing credential hashes that could be cracked offline.
💻 Affected Systems
- Relyum RELY-PCIe
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain password hashes, crack them offline, achieve administrative access, and compromise the entire industrial control system network.
Likely Case
Attackers with internal access extract password hashes, crack weaker passwords, and gain elevated privileges on affected devices.
If Mitigated
With proper network segmentation and monitoring, attackers may obtain hashes but cannot crack strong passwords or move laterally.
🎯 Exploit Status
Exploitation requires some level of system access to read the password file. The vulnerability is in file permissions configuration.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for latest patched version
Vendor Advisory: https://www.relyum.com/web/support/vulnerability-report/
Restart Required: Yes
Instructions:
1. Check current firmware version. 2. Download latest firmware from Relyum support portal. 3. Follow vendor's firmware update procedure. 4. Verify new version is installed. 5. Test device functionality.
🔧 Temporary Workarounds
Restrict File Permissions
linuxManually adjust permissions on the password hash file to restrict read access to authorized users only.
chmod 600 /etc/shadow
chown root:root /etc/shadow
Network Segmentation
allIsolate Relyum devices in separate network segments with strict access controls.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate affected devices from general network traffic
- Enable detailed logging and monitoring for unauthorized access attempts to system files
🔍 How to Verify
Check if Vulnerable:
Check if /etc/shadow file has overly permissive permissions (e.g., world-readable) on Relyum RELY-PCIe 22.2.1 devices using 'ls -la /etc/shadow'Check Version:
Check device web interface or use vendor-specific CLI command to display firmware versionVerify Fix Applied:
Verify /etc/shadow permissions are restricted (e.g., -rw-------) and confirm firmware version is updated beyond 22.2.1📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to /etc/shadow file
- Unexpected privilege escalation events
- Failed authentication followed by successful access
Network Indicators:
- Unusual network traffic to/from industrial control devices
- Protocol anomalies in industrial network segments
SIEM Query:
source="relyum-device" AND (event="file_access" AND file="/etc/shadow") OR (event="authentication" AND result="success" AFTER result="failure")