CVE-2024-4163
CVE-2024-4163 allows attackers to gain root access on Skylab IGX IIoT Gateways. This critical vulnerability arises from the gateway's limited shell terminal running with root privileges, enabling unauthorized file modifications. The vulnerability allows attackers to overwrite the /etc/passwd file, create a new root user, and break out of the restricted shell. Successful exploitation grants complete control over the IIoT Gateway. The SOCRadar Vulnerability Risk Score (SVRS) is 30, indicating a moderate risk, however, the potential for full system compromise requires prompt assessment and mitigation. While the CVSS score is 0, the risk associated with industrial control systems makes this a notable security concern. Immediate patching or mitigating actions are recommended to prevent potential breaches and maintain system integrity.
Description:
CVE-2024-4163 is a vulnerability in the Skylab IGX IIoT Gateway that allows attackers to gain root access to the device. This is due to the fact that the limited shell terminal (IGX) is running under root privileges, allowing attackers to read, write, and modify any file in the operating system.
Key Insights:
- The SVRS of 46 indicates that this vulnerability is of moderate severity and requires attention.
- Attackers can exploit this vulnerability to gain full control of the IIoT Gateway, which could allow them to disrupt operations or steal sensitive data.
- There are no known active exploits for this vulnerability at this time.
- CISA has not issued a warning for this vulnerability.
Mitigation Strategies:
- Update the Skylab IGX IIoT Gateway to the latest version, which includes a fix for this vulnerability.
- Disable the IGX limited shell terminal if it is not needed.
- Implement strong access controls to prevent unauthorized users from accessing the IIoT Gateway.
- Monitor the IIoT Gateway for suspicious activity and take appropriate action if necessary.
Additional Information:
If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.
Indicators of Compromise
Exploits
News
Social Media
Affected Software
References
CWE Details
CVE Radar
Real-time CVE Intelligence & Vulnerability Management Platform
CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.