CVE-2024-6912
📋 TL;DR
This vulnerability involves hard-coded MSSQL credentials in PerkinElmer ProcessPlus software on Windows, allowing attackers to remotely authenticate to the database server. All installations running affected versions are vulnerable, potentially exposing sensitive process data and system control.
💻 Affected Systems
- PerkinElmer ProcessPlus
📦 What is this software?
Processplus by Perkinelmer
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the MSSQL database, allowing data exfiltration, manipulation of industrial process data, and potential lateral movement to other systems.
Likely Case
Unauthorized access to process data, configuration tampering, and potential disruption of industrial operations.
If Mitigated
Limited impact if network segmentation prevents external access and credentials are changed.
🎯 Exploit Status
Exploitation requires only knowledge of hard-coded credentials and network access to MSSQL port (default 1433).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not provided in references
Restart Required: No
Instructions:
1. Contact PerkinElmer for updated version beyond 1.11.6507.0
2. Apply vendor-provided patch when available
3. Test in non-production environment first
🔧 Temporary Workarounds
Change MSSQL Credentials
windowsManually change the hard-coded MSSQL credentials in ProcessPlus configuration
-- Requires manual configuration change in ProcessPlus settings
-- Consult PerkinElmer documentation for credential location
Network Segmentation
windowsRestrict access to MSSQL port (1433) to only trusted systems
netsh advfirewall firewall add rule name="Block MSSQL External" dir=in action=block protocol=TCP localport=1433 remoteip=any
🧯 If You Can't Patch
- Implement strict network segmentation to isolate ProcessPlus systems from untrusted networks
- Change MSSQL credentials immediately and monitor for unauthorized access attempts
🔍 How to Verify
Check if Vulnerable:
Check ProcessPlus version in About dialog or installation directory. If version is 1.11.6507.0 or earlier, system is vulnerable.Check Version:
Check ProcessPlus executable properties or About menu within the applicationVerify Fix Applied:
Verify ProcessPlus version is above 1.11.6507.0 and test MSSQL authentication with old credentials fails.📡 Detection & Monitoring
Log Indicators:
- Failed MSSQL authentication attempts from unexpected sources
- Successful logins with default/hard-coded credentials
- Unusual database queries or access patterns
Network Indicators:
- Connection attempts to MSSQL port (1433) from unauthorized IPs
- Traffic patterns indicating database enumeration or exfiltration
SIEM Query:
source="mssql" AND (event_id=18454 OR event_id=18456) AND user="[hard-coded-username]"