CVE-2017-11401

Vulnerability

The vulnerability resides in the ModBus DPI filter of the Belden Hirschmann Tofino Xenon Security Appliance (versions before 03.2.00). The filter improperly validates the mbap.length field of ModBus packets, allowing attackers to craft packets that bypass function code filtering. Affected versions: all prior to 03.2.00 [1].

Exploitation

An attacker with network access to the appliance can send specially crafted ModBus packets with a malformed mbap.length field. The filter fails to properly parse the packet, allowing the attacker to bypass the intended function code restrictions. No authentication is required [1].

Impact

Successful exploitation allows the attacker to send arbitrary ModBus function codes to protected assets behind the appliance. This can lead to unauthorized control or disruption of industrial systems, potentially causing denial of service or physical damage [1].

Mitigation

Belden released version 03.2.00 to fix the issue. Users should upgrade to this version or later. There are no known workarounds; the appliance should not be exposed to untrusted networks [1].