Attack Chain

1. The attacker identifies a vulnerable Hirschmann HiEOS device accessible over the network via HTTP(S).
2. The attacker crafts a malicious HTTP(S) request designed to exploit the authentication bypass. This request likely targets specific endpoints in the management module.
3. The attacker sends the crafted HTTP(S) request to the vulnerable HiEOS device.
4. Due to improper authentication handling, the device incorrectly processes the request, granting the attacker administrative privileges.
5. The attacker leverages the elevated privileges to download the device configuration, potentially exposing sensitive information.
6. The attacker modifies the device configuration, injecting malicious settings or backdoors.
7. The attacker uploads the modified configuration to the HiEOS device, effectively compromising its functionality.
8. Alternatively, the attacker could use their elevated privileges to upload and install a modified firmware image. This allows complete control over the device and can ensure persistence.

Impact

Successful exploitation of CVE-2024-14034 allows an unauthenticated attacker to gain full administrative control over the targeted Hirschmann HiEOS device. This can lead to device configuration modification, firmware manipulation, and potential disruption of network services relying on the compromised device. Given the nature of HiEOS devices, successful attacks can impact industrial control systems (ICS) and critical infrastructure. A CVSS v3.1 base score of 9.8 reflects the critical severity and potential impact.

Recommendation

• Apply the patches or mitigations provided in the Belden Security Bulletin BSECV-2024-02 (reference URL in the References section) to remediate CVE-2024-14034.
• Monitor webserver logs for unusual HTTP requests targeting the HiEOS management interface using the Sigma rule “Detect Suspicious HiEOS Management Requests”.
• Implement network segmentation to limit the exposure of HiEOS devices and reduce the potential impact of a successful attack.
• Regularly review and update firmware on HiEOS devices to address known vulnerabilities and improve overall security posture.