27.02.2013 Views

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

Description: Synopsis :\n\nThe remote host may give an attacker information useful for future<br />

attacks.\n\nThe remote server is running the MODBUS protocol. This protocol is common<br />

on SCADA or process control networks. In addition, the PLC is running with 'Diagnostics'<br />

enabled. This is very dangerous, as it can give attackers information that can be used to<br />

exploit the machine.<br />

Solution: Only allow diagnostic sessions from trusted clients.<br />

CVE Not available<br />

Modicon PLC Embedded HTTP Server Detection (SCADA)<br />

<strong>PVS</strong> ID: 3850 FAMILY: SCADA RISK: LOW NESSUS ID:Not Available<br />

Description: The Modicon Quantum, Premium and Micro models of PLC have an HTTP server<br />

interface. The Modicon PLC web server and content was identified on the host. The banner<br />

is reporting version %L<br />

Solution: Filter access to TCP port 80 to authorized management addresses.<br />

CVE Not available<br />

Modicon PLC Default FTP Password (SCADA)<br />

<strong>PVS</strong> ID: 3851 FAMILY: SCADA RISK: HIGH NESSUS ID:Not Available<br />

Description: Synopsis :\n\nThe remote host is configured with default or easily-guessed<br />

credentials.\n\nThe ethernet modules on Modicon Quantum, Premium and Micro brand<br />

PLC's have an FTP server. The FTP server has one account that can be modified. The<br />

default account has the ability to load programs and change the configuration and<br />

programming of the PLC.<br />

Solution: Change the username and password for the FTP server.<br />

CVE Not available<br />

Modicon Modbus/TCP Programming Function Code Access (SCADA)<br />

<strong>PVS</strong> ID: 3852 FAMILY: SCADA RISK: HIGH NESSUS ID:Not Available<br />

Description: Synopsis :\n\nThe remote host is running an inherently insecure protocol or<br />

application.\n\nThe proprietary Modbus/TCP function code 126 is active on this Modbus<br />

slave. An attacker who is able to gain network access to this device may be able to<br />

reprogram PLC logic or otherwise impact the integrity of the physical process.<br />

Solution: Filter incoming traffic on this port to authorized Modbus TCP clients.<br />

CVE Not available<br />

Passive Vulnerability Scanner (<strong>PVS</strong>) <strong>Signatures</strong><br />

Modicon PLC HTTP Server Default Username/Password (SCADA)<br />

Family Internet Services 996

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!