Headline
CVE-2021-21963: TALOS-2021-1391 || Cisco Talos Intelligence Group
An information disclosure vulnerability exists in the Web Server functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted man-in-the-middle attack can lead to a disclosure of sensitive information. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.
Summary
An information disclosure vulnerability exists in the Web Server functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted man-in-the-middle attack can lead to a disclosure of sensitive information. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.
Tested Versions
Sealevel Systems, Inc. SeaConnect 370W v1.3.34
Product URLs
SeaConnect 370W - https://www.sealevel.com/product/370w-a-wifi-to-form-c-relays-digital-inputs-a-d-inputs-and-1-wire-bus-seaconnect-multifunction-io-edge-module-powered-by-seacloud/
CVSSv3 Score
7.4 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE
CWE-311 - Missing Encryption of Sensitive Data
Details
The SeaConnect 370W is a Wi-Fi connected IIoT device offering programmable cloud access and control of digital and analog I/O and a 1-wire bus.
This device offers remote control via several means including MQTT, Modbus TCP and a manufacturer-specific protocol named “SeaMAX API”.
The device is built on top of the TI CC3200 MCU with built-in Wi-Fi capabilities.
The SeaConnect 370W is host to a web server which enables an authenticated user to view and edit various device configurations, such as analog and digital input and output states, wireless network profiles and device events. In order to access any of the features of the web server, a user must supply a valid username and password. The username and password are provided using the HTTP Basic Auth method, meaning the username and password are sent as a Base64 encoded value in the Authentication header field. This device does not support the use of TLS when interacting with the web server, so an attacker capable of sniffing network traffic between a user and the device could easily extract sensitive information from the HTTP stream.
At the time of this research, the web server was hosted through the TI ‘SimpleLink’ SDK, which TI notes in their documentation does not support HTTPS.
Timeline
2021-10-26 - Vendor Disclosure
2022-01-27 - Vendor Patched
2022-02-01 - Public Release
Discovered by a member of Cisco Talos.