Schneider Electric Enerlin'X Com 'X 510
Plan Patch8.5ICS-CERT ICSA-21-168-01Jun 17, 2021
Attack VectorNetwork
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
An improper privilege escalation vulnerability in the Enerlin'X Com'X 510 communication module allows any authenticated user to escalate privileges and access sensitive device configuration information. This includes credentials for remote SMTP, FTP, and HTTPS services that the device is configured to communicate with. The vulnerability affects all versions prior to 6.8.4. Risk is elevated if the device's default Guest account password has not been changed from its default value.
What this means
What could happen
An authenticated user could gain escalated privileges on the Enerlin'X Com'X 510 and access sensitive device configuration information including remote service credentials for SMTP, FTP, and HTTPS. This could allow an attacker to reconfigure the device or pivot to other systems.
Who's at risk
Energy utilities and industrial operators using Enerlin'X Com'X 510 communication modules for SCADA, power automation, or remote monitoring systems. This particularly affects organizations that use the device for remote access to critical infrastructure or that rely on the device's remote service configuration for SMTP email alerts, FTP data transfer, or HTTPS communications.
How it could be exploited
An attacker with valid credentials to the Com'X 510 (including the default Guest account if not changed) can exploit an improper privilege escalation vulnerability to elevate their access level. Once escalated, they can read device configuration files containing passwords and settings for remote services like SMTP, FTP, or HTTPS servers that the device communicates with.
Prerequisites
- Valid user credentials for the Enerlin'X Com'X 510 device (including default Guest account if unchanged)
- Network access to the device's management interface
- Device must be reachable from the attacker's network location
Requires valid credentials (reduces immediate risk)Affects configuration and credential disclosureDefault credentials (Guest account) present higher risk if not changedCVSS score 8.5 (high severity)Network reachability allows remote exploitation
Exploitability
Low exploit probability (EPSS 0.2%)
Affected products (1)
ProductAffected VersionsFix Status
Enerlin'X Com'X 510: All< 6.8.46.8.4
Remediation & Mitigation
0/5
Do now
0/2HARDENINGChange the Guest account password from the default value to a unique, strong password
HARDENINGIf the Com'X 510 is configured to access remote SMTP, FTP, or HTTPS services, change all passwords on those remote services and update the Com'X configuration with new credentials
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXUpdate Enerlin'X Com'X 510 firmware to version 6.8.4 or later
Long-term hardening
0/2HARDENINGRestrict network access to the Com'X 510 device; do not expose it to the Internet and place it behind a firewall
HARDENINGIsolate the Com'X 510 and associated control system networks from the business network
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/0b645b1e-e6cd-4d5d-b2e6-6667cc272230