TFTP Without Authentication

Vulnerability

The Korenix JetNet series industrial switches expose a TFTP (Trivial File Transfer Protocol) service that lacks any authentication mechanism. An attacker can connect to this service and upload files without providing credentials. This issue affects all JetNet devices running firmware versions prior to 2024/01, including models such as JetNet 4508, 4508f, 5620G-4C, 5612GP-4F, 5612G-4F, 5728G, 6528Gf, 6628XP-4F, 6628X-4F, 6728G, 6828Gf, 6910G-M12, 7310G-V2, 7628XP-4F, 7628X-4F, and 7714G-M12 [2].

Exploitation

The attacker only needs network access to the TFTP service running on the target device. No authentication or prior access is required. By using a TFTP client, the attacker can upload a malicious firmware image to the device. The exact sequence involves connecting to the TFTP endpoint and executing a PUT request with the crafted firmware file. The service does not verify the identity of the uploader, allowing the attacker to overwrite the device's firmware [2].

Impact

Successful exploitation enables an attacker to replace the legitimate firmware with a malicious version. This grants the attacker the ability to execute arbitrary code on the device with full system privileges (remote code execution). As a result, the attacker can fully compromise the device, potentially using it as a foothold in the industrial network, disrupting operations, or exfiltrating sensitive data [2].

Mitigation

Korenix has released firmware version 2024/01 to address this issue. Users should update their JetNet devices to this version or later, as specified in the vendor advisory [1][2]. No workaround is mentioned in the available references; updating the firmware is the recommended course of action. Devices that are no longer supported should be replaced or isolated from untrusted networks.