CVE-2024-0390
📋 TL;DR
The INPRAX 'iZZi connect' Android application contains hard-coded MQTT queue credentials that are shared with physical recuperation devices. This allows attackers to gain unauthorized access to manage and read parameters of the 'reQnet iZZi' recuperation units. This affects all users of 'iZZi connect' Android app versions before 2024010401.
💻 Affected Systems
- INPRAX iZZi connect Android application
- reQnet iZZi recuperation units
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of connected recuperation units allowing attackers to manipulate device parameters, potentially causing physical damage or safety hazards, and accessing sensitive operational data.
Likely Case
Unauthorized monitoring of device parameters and potential manipulation of non-critical settings, leading to privacy violations and operational interference.
If Mitigated
Limited impact if devices are isolated from internet access and MQTT traffic is restricted to internal networks only.
🎯 Exploit Status
Exploitation requires access to the hard-coded credentials which are embedded in the application. No authentication needed once credentials are obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2024010401
Vendor Advisory: https://cert.pl/en/posts/2024/02/CVE-2024-0390/
Restart Required: Yes
Instructions:
1. Update 'iZZi connect' Android app to version 2024010401 or later via Google Play Store. 2. Ensure connected recuperation units are updated if applicable. 3. Restart both application and devices after update.
🔧 Temporary Workarounds
Network Isolation
allIsolate recuperation devices and MQTT traffic from internet access
MQTT Credential Rotation
allChange MQTT queue credentials on all affected devices
🧯 If You Can't Patch
- Disconnect recuperation units from network entirely
- Implement strict network segmentation to isolate MQTT traffic
🔍 How to Verify
Check if Vulnerable:
Check app version in Android settings. If version is earlier than 2024010401, system is vulnerable.Check Version:
Not applicable - check via Android app settingsVerify Fix Applied:
Confirm app version is 2024010401 or later in Android app settings.📡 Detection & Monitoring
Log Indicators:
- Unauthorized MQTT connections to recuperation device queues
- Unexpected parameter changes in device logs
Network Indicators:
- MQTT traffic from unexpected sources
- Unusual patterns in MQTT protocol communications
SIEM Query:
source="mqtt" AND (event_type="connection" OR event_type="publish") AND NOT src_ip IN [authorized_ips]