CVE-2021-21963
An information disclosure vulnerability exists in the Web Server functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted man-in-the-middle attack can lead to a disclosure of sensitive information. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.
Sealevel Systems, Inc. SeaConnect 370W v1.3.34
7.4 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-311 - Missing Encryption of Sensitive Data
The SeaConnect 370W is a Wi-Fi connected IIoT device offering programmable cloud access and control of digital and analog I/O and a 1-wire bus.
This device offers remote control via several means including MQTT, Modbus TCP and a manufacturer-specific protocol named “SeaMAX API”.
The device is built on top of the TI CC3200 MCU with built-in Wi-Fi capabilities.
The SeaConnect 370W is host to a web server which enables an authenticated user to view and edit various device configurations, such as analog and digital input and output states, wireless network profiles and device events. In order to access any of the features of the web server, a user must supply a valid username and password. The username and password are provided using the HTTP Basic Auth method, meaning the username and password are sent as a Base64 encoded value in the Authentication header field. This device does not support the use of TLS when interacting with the web server, so an attacker capable of sniffing network traffic between a user and the device could easily extract sensitive information from the HTTP stream.
At the time of this research, the web server was hosted through the TI ‘SimpleLink’ SDK, which TI notes in their documentation does not support HTTPS.
2021-10-26 - Vendor disclosure
2022-02-01 - Public Release
Discovered by a member of Cisco Talos.