The Auto-Maskin DCU 210E firmware contains an undocumented Dropbear SSH server, v2015.55, configured to listen on Port 22 while the DCU is running and is configured with a hard-coded credentials

Vulnerability

The Auto-Maskin DCU 210E and RP 210E firmware versions prior to 3.7 on ARMv7 contain an undocumented Dropbear SSH server (v2015.55) listening on port 22 while the device is running [1][2]. The server is configured with a hard-coded username and password combination of root / amroot and uses password-only authentication (no cryptographic keys) [1]. The hard-coded credential is present in the firmware image, and the password is easily susceptible to cracking [2].

Exploitation

An attacker can exploit this vulnerability remotely without any authentication or prior access, as the Dropbear server is exposed on port 22 [1]. The attacker only needs network connectivity to the device and can use any SSH client to connect with the hard-coded credentials root and amroot [1][2]. No user interaction or additional privileges are required; the SSH server is active by default [1].

Impact

Successful exploitation grants the attacker root access to the Angstrom Linux operating system running on the device [1][2]. With root privileges, the attacker can modify any binaries, configuration files, or system settings in the firmware, potentially leading to full compromise of the device and the ability to manipulate monitored engine controls [1][2]. The scope of the compromise includes both read and write access to critical system files [1].

Mitigation

According to CISA advisory ICSA-20-051-04, the affected versions are RP210E and DCU210E versions 3.7 and prior [1]. At the time of the CERT/CC vulnerability note (2018-10-06), no update was available to address these vulnerabilities [2]. Users are encouraged to contact Auto-Maskin for fixed firmware releases. As a workaround, these critical control devices should only be deployed on private, carefully secured networks with restricted access [1][2]. No KEV listing is present at the time of writing.