CVE-2024-6421
📋 TL;DR
CVE-2024-6421 allows unauthenticated remote attackers to read sensitive device information through an incorrectly configured FTP service. This affects devices running vulnerable FTP implementations with improper access controls. Organizations using affected FTP services on network devices are at risk.
💻 Affected Systems
- Specific products not detailed in provided references
📦 What is this software?
Oit1500 F113 B12 Cb Firmware by Pepperl Fuchs
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise leading to network infiltration, credential theft, and lateral movement across infrastructure.
Likely Case
Exposure of sensitive configuration data, credentials, and device information enabling reconnaissance for further attacks.
If Mitigated
Limited information disclosure with no access to critical systems or data.
🎯 Exploit Status
Exploitation requires only FTP client access to vulnerable service.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: https://cert.vde.com/en/advisories/VDE-2024-038
Restart Required: No
Instructions:
1. Review vendor advisory for specific product guidance. 2. Apply configuration changes to FTP service. 3. Test functionality after changes.
🔧 Temporary Workarounds
Disable Anonymous FTP Access
allConfigure FTP service to require authentication for all access
Edit FTP configuration file to set 'anonymous_enable=NO' or equivalent
Restrict FTP Directory Access
allConfigure FTP service to limit accessible directories to non-sensitive locations
Edit FTP configuration to set appropriate chroot or directory restrictions
🧯 If You Can't Patch
- Implement network segmentation to isolate FTP services
- Deploy network-based controls to block unauthenticated FTP access
🔍 How to Verify
Check if Vulnerable:
Attempt anonymous FTP connection to service and check if sensitive directories are accessibleCheck Version:
Check FTP service version and configuration settingsVerify Fix Applied:
Test that anonymous FTP connections are rejected and authenticated access works properly📡 Detection & Monitoring
Log Indicators:
- Anonymous FTP login attempts
- Access to sensitive directories via FTP
Network Indicators:
- Unusual FTP traffic patterns
- Multiple failed authentication attempts
SIEM Query:
source="ftp.log" AND (anonymous_login OR access_denied)