CVE-2021-37292

HIGHNuclei

KevinLAB BEMS (Building Energy Management System) - Backdoor Account

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2021-37292 has a selected CVSS score of 7.2 (high); EIP currently links 1 Nuclei template.

Description

An Access Control vulnerability exists in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 due to an undocumented backdoor account. A malicious user can log in using the backdor account with admin highest privileges and obtain system control.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryHIGHKevinLAB BEMS (Building Energy Management System) - Backdoor AccountCVSS 7.2

KevinLAB BEMS has an undocumented backdoor account, and these sets of credentials are never exposed to the end-user and cannot be changed through any normal operation of the solution through the RMI. An attacker could exploit this vulnerability by logging in using the backdoor account with highest privileges for administration and gain full system control. The backdoor user cannot be seen in the users settings in the admin panel, and it also uses an undocumented privilege level (admin_pk=1) which allows full availability of the features that the BEMS is offering remotely.

Impact

Attackers using hardcoded backdoor credentials (kevinlab/kevin003) can gain full administrative access with highest privileges to KevinLAB BEMS, bypassing all authentication mechanisms.

Remediation

Remove the hardcoded backdoor account or upgrade to a patched version of KevinLAB BEMS.

Authorsgy741
Template tagscvecve2021kevinlabbemsbackdoorvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:kevinlab:4st_l-bems:1.0.0:*:*:*:*:*:*:*
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5654.php https://nvd.nist.gov/vuln/detail/cve-2021-37292

Source: ProjectDiscovery

References

3