CVE-2021-3252
Credentials will always be returned in plain-text from the local server during the KACO XP100U authentication process, regardless of whatever passwords have been provided, which leads to an information disclosure vulnerability.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.59%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
KACO New Energy XP100U Up to XP-JAVA 2.0 is affected by incorrect access control. Credentials will always be returned in plain-text from the local server during the KACO XP100U authentication process, regardless of whatever passwords have been provided, which leads to an information disclosure vulnerability.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 2.59% probability · 84th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-522
- Affected
- kaco-newenergy/xp100u firmware
- Source
- cve@mitre.org
References
- https://tiger-team-1337.blogspot.com/2021/01/kaco-xp100u-hmi-credential-leak.htmlExploit, Technical Description, Third Party Advisory
- https://twitter.com/Kevin2600/status/1351189347501023238Third Party Advisory
- https://us-cert.cisa.gov/ics/alerts/ICS-ALERT-15-224-01Third Party Advisory, US Government Resource
- https://tiger-team-1337.blogspot.com/2021/01/kaco-xp100u-hmi-credential-leak.htmlExploit, Technical Description, Third Party Advisory
- https://twitter.com/Kevin2600/status/1351189347501023238Third Party Advisory
- https://us-cert.cisa.gov/ics/alerts/ICS-ALERT-15-224-01Third Party Advisory, US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.