CVE-2018-11311 Explained : Impact and Mitigation

In May 2018, CVE-2018-11311 was published, highlighting a security vulnerability in mySCADA myPRO 7 that allows unauthorized access to the FTP server using hardcoded credentials.

Understanding CVE-2018-11311

What is CVE-2018-11311?

The vulnerability in 'myscadagate.exe' in mySCADA myPRO 7 exposes preset FTP credentials (username: myscada, password: Vikuk63), enabling unauthorized individuals to remotely access the FTP server on port 2121.

The Impact of CVE-2018-11311

The exploitation of this vulnerability permits attackers to upload files or view directory listings on the FTP server, compromising data integrity and confidentiality.

Technical Details of CVE-2018-11311

Vulnerability Description

The presence of hardcoded FTP credentials in 'myscadagate.exe' facilitates unauthorized access to the FTP server, posing a significant security risk.

Affected Systems and Versions

Product: mySCADA myPRO 7
Vendor: mySCADA
Versions: All versions are affected

Exploitation Mechanism

Unauthorized individuals can exploit the vulnerability by using the predetermined FTP username and password to gain remote access to the FTP server on port 2121.

Mitigation and Prevention

Immediate Steps to Take

Change the default FTP credentials to unique and secure ones.
Restrict FTP server access to trusted IP addresses.
Monitor FTP server logs for any suspicious activities.

Long-Term Security Practices

Implement regular security audits and vulnerability assessments.
Educate users on secure password practices and the importance of credential management.

Patching and Updates

Apply patches or updates provided by mySCADA to address the hardcoded credentials issue and enhance overall system security.