Eaton: Hardcoded SSH root password in XC-303 firmware

Critical9.1CVE-2024-57811 · Published Sep 13, 2024 · updated Jan 15, 2025

### Summary An attacker with network access to a XC-303 PLC running firmware below 3.5.17 Bugfix 1 can login as root over SSH. The root password is hardcoded in the firmware. ### Severity Critical - Hardcoded password allows malicious actors to login as root over SSH. ### Proof of Concept When on the same network as a XC-303 device running a vulnerable version, you can log in as root over SSH with the following credentials: ``` root:Etn602 ``` ### Further Analysis The root password can be found in the XSOFT-CODESYS software: it is stored in clear text in the firmware updater tool. Versions 3.5.16 and below use the insecure `crypt` algorithm to store the root password hash in `/etc/shadow`: the password hash "qFGk7N4OWLwR2" can be easily brute-forced. If this vulnerability is exploited, it allows an attacker to persist on the device across reboots and updates (the device has no secure boot). ### Timeline **Date reported**: 08/09/2024 **Date fixed**: 10/02/2023 (Eaton discovered this vulnerability as part of an internal regular cybersecurity assessment) **Date disclosed**: 09/13/2024 This issue was discovered and patched in v3.5.17 Bugfix 1.