Critical RCE Vulnerability in X-Rite MA-T6 Devices (CVE-2023-49900)

A critical vulnerability, CVE-2023-49900, affecting X-Rite MA-T6 devices running firmware versions prior to v2.33 has been disclosed. This vulnerability allows an unauthenticated remote attacker to perform remote code execution (RCE) with a CVSS v3.1 score of 9.8. The root cause is improper neutralization of special elements used in an OS command (CWE-78), specifically in the SetParameter command. Attackers can inject arbitrary operating system commands due to a lack of proper input sanitization when processing user-supplied input. This vulnerability poses a significant risk as it permits complete compromise of the affected device, potentially leading to data manipulation, system disruption, or further network infiltration. Organizations utilizing X-Rite MA-T6 devices should prioritize patching or implementing mitigation strategies immediately to prevent exploitation.

Attack Chain

1. An unauthenticated remote attacker identifies a vulnerable X-Rite MA-T6 device accessible over the network.
2. The attacker crafts a malicious SetParameter command containing specially engineered input that includes OS command injection payloads.
3. The crafted command is transmitted over the network to the vulnerable X-Rite MA-T6 device.
4. The device receives and processes the SetParameter command without adequately sanitizing the user-supplied input.
5. The injected operating system commands are executed by the device's underlying system with the privileges of the affected service.
6. The attacker gains remote code execution on the MA-T6 device, enabling unauthorized control, data access, or system alteration.
7. This full system compromise can lead to data exfiltration, device manipulation, or serve as a pivot point for further attacks within the internal network.

Impact

Successful exploitation of CVE-2023-49900 allows an unauthenticated attacker to achieve full remote code execution on the vulnerable X-Rite MA-T6 device. This can lead to complete compromise of the device, enabling the attacker to manipulate its functions, extract sensitive data it processes, or disrupt its operation. Given that these devices are typically used in industrial or quality control environments, the impact could extend to production downtime, compromised product quality, or even safety risks. There is no specific information on the number of victims or targeted sectors, but any organization using unpatched X-Rite MA-T6 devices is at risk.

Recommendation

• Patch CVE-2023-49900 by upgrading X-Rite MA-T6 devices to v2.33 or later immediately.
• Review network segmentation to ensure X-Rite MA-T6 devices are not directly exposed to the internet.
• Monitor network traffic for unusual command execution patterns or unauthorized access attempts targeting X-Rite MA-T6 devices.