Multiple vulnerabilities in Digi ConnectPort X2e
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 2 |
| CVE-ID | CVE-2020-9306 CVE-2020-12878 |
| CWE-ID | CWE-798 CWE-264 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
SolarCity Solar Monitoring Gateway Other software / Other software solutions ConnectPort X2e Hardware solutions / Firmware |
| Vendor |
Tesla Digi International Inc. |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
1) Use of hard-coded credentials
EUVDB-ID: #VU50807
Risk: Low
CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2020-9306
CWE-ID:
CWE-798 - Use of Hard-coded Credentials
Exploit availability: No
DescriptionThe vulnerability allows a local user to gain full access to vulnerable system.
The vulnerability exists due to the Digi ConnectPort X2e uses a .pyc file to store the cleartext password for the python user account. A local user can access the affected system using the hard-coded credentials.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsSolarCity Solar Monitoring Gateway: 5.46.43
ConnectPort X2e: before 3.2.30.6
CPE2.3- cpe:2.3:a:tesla:solarcity_solar_monitoring_gateway:5.46.43:*:*:*:*:*:*:
- cpe:2.3:h:digi_international:connectport_x2e:*:*:*:*:*:*:*:
http://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2020-0019/FEYE-2020-0019.md
http://www.fireeye.com/blog/threat-research.html
http://www.fireeye.com/blog/threat-research/2021/02/solarcity-exploitation-of-x2e-iot-device-part-one.html
http://www.fireeye.com/blog/threat-research/2021/02/solarcity-exploitation-of-x2e-iot-device-part-two.html
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Permissions, Privileges, and Access Controls
EUVDB-ID: #VU50808
Risk: Medium
CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2020-12878
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to escalate privileges on the system.
The vulnerability exists due to application does not properly impose security restrictions. A remote authenticated attacker can escalate privileges from the python user to root via a symlink attack that uses chown, related to /etc/init.d/S50dropbear.sh and the /WEB/python/.ssh directory.
MitigationInstall updates from vendor's website.
Vulnerable software versionsConnectPort X2e: before 3.2.30.6
CPE2.3 External linkshttp://github.com/fireeye/Vulnerability-Disclosures
http://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2020-0020/FEYE-2020-0020.md
http://www.digi.com/support/productdetail?pid=5570
http://www.fireeye.com/blog/threat-research/2021/02/solarcity-exploitation-of-x2e-iot-device-part-one.html
http://www.fireeye.com/blog/threat-research/2021/02/solarcity-exploitation-of-x2e-iot-device-part-two.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
