Kieback&Peter DDC4000 Series Path Traversal Insufficiently Protected Credentials
Kieback & Peter's DDC4000 series has an insufficiently protected credentials vulnerability, which may allow an unauthenticated attacker with access to /etc/passwd to read the password hashes of all users on the system.
Kieback&Peter DDC4000 Series Path Traversal Insufficiently Protected Credentials
Kieback & Peter's DDC4000 series has an insufficiently protected credentials vulnerability, which may allow an unauthenticated attacker with access to /etc/passwd to read the password hashes of all users on the system.
Kieback&Peter DDC4002, DDC4100, DDC4200, DDC4200-L and DDC4400
controllers are considered End-of-Life (EOL) and are no longer
supported. Users operating these controllers should ensure they are
operated in a strictly separate OT environment and consider updating to a
supported controller.
Kieback&Peter recommends users update to DDC4002e, DDC4200e, DDC4400e, DDC4020e and DDC4040e controllers.
Kieback&Peter recommends all affected users contact their local
Kieback&Peter office to update the firmware of the supported DDC
systems to v1.21.0 or later.
Configurations
Workarounds
Exploits
Credits
finder
Raphael Ruf of terreActive AG reported these vulnerabilities to CISA.
Kieback & Peter's DDC4000 series has an insufficiently protected credentials vulnerability, which may allow an unauthenticated attacker with access to /etc/passwd to read the password hashes of all users on the system.