Meinberg LANTIME Remote Code Execution (CVE-2020-7240)

high Tenable OT Security Plugin ID 502232

Synopsis

The remote OT asset is affected by a vulnerability.

Description

Meinberg Lantime devices allow attackers (with privileges to configure a device) to execute arbitrary OS commands by editing the /config/netconf.cmd script (aka Extended Network Configuration). Note: According to the description, the vulnerability requires a fully authenticated super-user account using a webUI function that allows super users to edit a script supposed to execute OS commands. The given weakness enumeration (CWE-78) is not applicable in this case as it refers to abusing functions/input fields not supposed to be accepting OS commands by using 'Special Elements.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Solution

Deactivate web interface (deactivate HTTP/HTTPS).

The intended feature that is used in CVE-2020-7240 is only allowed to super users which have root access. Other authenticated users are not allowed to use this functionality. Due to the need of the highest access rights we do not currently plan to change this behavior.

Plugin Details

Severity: High

ID: 502232

Version: 1.1

Type: remote

Family: Tenable.ot

Published: 5/2/2024

Updated: 5/3/2024

Supported Sensors: Tenable OT Security

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2020-7240

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/h:meinberg:ims-lantime_m1000, cpe:/h:meinberg:ims-lantime_m1000s, cpe:/h:meinberg:ims-lantime_m3000, cpe:/h:meinberg:ims-lantime_m3000s, cpe:/h:meinberg:ims-lantime_m4000, cpe:/h:meinberg:ims-lantime_m500, cpe:/h:meinberg:lantime_m100, cpe:/h:meinberg:lantime_m200, cpe:/h:meinberg:lantime_m300, cpe:/h:meinberg:lantime_m400, cpe:/h:meinberg:lantime_m600, cpe:/h:meinberg:lantime_m900

Required KB Items: Tenable.ot/Meinberg

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 1/20/2020

Vulnerability Publication Date: 1/20/2020

Reference Information

CVE: CVE-2020-7240

CWE: 78

Detections

Analytics