Trawler
17 of 17 entries
| ID | Risk | Title | CVSS | CWE |
|---|---|---|---|---|
PT-001 |
MEDIUM |
Hardcoded Public DNS Resolvers Bypass Enterprise Controls
Device sends DNS queries directly to public resolvers (8.8.8.8, 1.1.1.1, etc.) instead of using the DHCP-supplied resolv...
|
5.3 | CWE-441 CWE-200 |
PT-002 |
LOW |
Cleartext DNS Exposes External Service Topology
All DNS queries are sent over cleartext UDP/53. Any on-path observer can enumerate the full set of external services the...
|
3.7 | CWE-200 CWE-319 |
PT-003 |
LOW |
Device Identity Leaked in TLS Client Certificate (mTLS)
The device authenticates with a client X.509 certificate (mTLS). The certificate subject is sent in cleartext during the...
|
3.7 | CWE-200 CWE-319 |
PT-004 |
LOW |
TLS ClientHello Offers Legacy CBC Cipher Suites
The device's TLS ClientHello offers legacy CBC-mode cipher suites alongside modern AEAD ciphers. While AEAD is typically...
|
3.1 | CWE-327 CWE-326 |
PT-005 |
MEDIUM |
DHCP Hostname Discloses Asset Identifier
The device populates DHCP option 12 (Host Name) with an asset identifier (serial number, device tag) that is broadcast o...
|
4.3 | CWE-200 CWE-359 |
PT-006 |
MEDIUM |
DNS Search-Suffix Appended to Fully-Qualified Hostnames
The device's DNS client appends the DHCP-supplied search domain to hostnames that are already fully-qualified. RFC 1535 ...
|
6.5 | CWE-345 CWE-20 |
PT-101 |
HIGH |
SMBv1 Traffic Observed (EternalBlue / NotPetya exposure)
SMBv1 protocol traffic observed between the device and one or more internal peers. SMBv1 is deprecated since 2014 and is...
|
8.1 | CWE-477 |
PT-102 |
HIGH |
LLMNR / NBT-NS Name Resolution in Use (Responder Surface)
LLMNR or NetBIOS Name Service broadcast-based name resolution is in use on the segment. These protocols are abused by Re...
|
8.1 | CWE-290 CWE-300 |
PT-103 |
LOW |
SSDP / UPnP Broadcasts Expose Internal Services
SSDP/UPnP discovery traffic observed on the segment. SSDP advertises every UPnP-aware device (smart TVs, consumer router...
|
3.1 | CWE-200 |
PT-104 |
LOW |
mDNS Activity Exposes Device Identity on Internal Segment
Device emits mDNS queries and/or responses on the local segment. mDNS exposes the device's hostname and services to any ...
|
3.1 | CWE-200 |
PT-105 |
LOW |
LLDP Topology / Switch Firmware Disclosure
LLDP TLVs observed on the segment leak switch identity, model and firmware. Information that downstream attackers can us...
|
3.1 | CWE-200 |
PT-106 |
MEDIUM |
ARP Anomalies (Duplicate IP-to-MAC Mappings)
Duplicate ARP entries observed — one IP advertised by multiple MAC addresses. Possible legitimate HA pair, gratuitous AR...
|
6.5 | CWE-290 CWE-300 |
PT-107 |
HIGH |
Cleartext FTP Traffic Observed (credentials in plaintext)
FTP control-channel traffic observed in cleartext. FTP USER/PASS commands and file contents are passively captureable by...
|
7.4 | CWE-319 CWE-523 |
PT-108 |
HIGH |
Cleartext Telnet Traffic Observed
Telnet traffic observed in cleartext. Telnet credentials and keystrokes are sent in plaintext and trivially captured by ...
|
7.4 | CWE-319 CWE-523 |
PT-109 |
MEDIUM |
SNMPv1/v2c Community String in Cleartext
SNMP community strings (passwords) observed in plaintext. Communities like 'public' / 'private' / vendor-default values ...
|
5.3 | CWE-319 CWE-521 |
PT-110 |
HIGH |
HTTP Basic Authentication Observed in Cleartext
HTTP Basic Auth headers observed in cleartext. Authorization: Basic <base64> is one base64-decode step away from usernam...
|
7.4 | CWE-319 CWE-523 |
PT-111 |
MEDIUM |
LDAP Bind Observed Without TLS
LDAP bind request observed in cleartext. Without LDAPS or StartTLS, the bind DN and password are exposed.
|
5.9 | CWE-319 CWE-523 |
Detailed View
MEDIUM PT-001 — Hardcoded Public DNS Resolvers Bypass Enterprise Controls
Description: Device sends DNS queries directly to public resolvers (8.8.8.8, 1.1.1.1, etc.) instead of using the DHCP-supplied resolver, bypassing enterprise DNS filtering, sinkholing, anomaly detection and split-DNS.
Impact: Enterprise DNS controls are bypassed for the device's most security-relevant traffic. Security teams cannot detect or block the device contacting unexpected endpoints, cannot apply DNS-based egress restrictions, and cannot audit data-exfiltration patterns. Represents a HIPAA / SOC 2 logging control gap.
Remediation: Modify device firmware to use only the DHCP-supplied DNS resolver. Implement DoH/DoT. Provide deployment-time toggle for hospital IT to constrain the resolver.
Effort: Moderate
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NOWASP Web: A09:2021 Security Logging and Monitoring Failures
MITRE ATT&CK: T1071.004 (Command and Control)
NIST 800-53: SC-7, SC-20, AU-12
PCI DSS 4: 1.4.1, 10.2.1.1
LOW PT-002 — Cleartext DNS Exposes External Service Topology
Description: All DNS queries are sent over cleartext UDP/53. Any on-path observer can enumerate the full set of external services the device depends on.
Impact: An attacker who can passively observe device traffic learns the entire backend architecture without active probing — cloud-provider endpoints, push-notification dependencies, captive-portal probe destinations and SaaS services in use.
Remediation: Implement DNS-over-HTTPS (RFC 8484) or DNS-over-TLS (RFC 7858) on the device.
Effort: Moderate
CVSS Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:NOWASP Web: A02:2021 Cryptographic Failures
MITRE ATT&CK: T1071.004 (Command and Control)
NIST 800-53: SC-8, SC-20
LOW PT-003 — Device Identity Leaked in TLS Client Certificate (mTLS)
Description: The device authenticates with a client X.509 certificate (mTLS). The certificate subject is sent in cleartext during the handshake and exposes identifying information (serial, model, vendor PKI topology).
Impact: Passive observers can extract the device's identity from the TLS handshake bytes without decrypting any application data. Privacy-relevant in clinical contexts where the presence of a particular medical device indicates the patient population being served.
Remediation: Use opaque per-device identifier (UUID) as the Subject CN. Move human-readable serial / model into a custom certificate extension or SubjectAltName otherName.
Effort: Significant
CVSS Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:NOWASP Web: A02:2021 Cryptographic Failures
NIST 800-53: SC-12, SC-17, IA-5
LOW PT-004 — TLS ClientHello Offers Legacy CBC Cipher Suites
Description: The device's TLS ClientHello offers legacy CBC-mode cipher suites alongside modern AEAD ciphers. While AEAD is typically negotiated, the CBC offer preserves a downgrade surface.
Impact: CBC suites are vulnerable to historical attacks (BEAST, Lucky13, POODLE-variants) when paired with TLS 1.0/1.1. In TLS 1.2 with correct implementation the practical exploit cost is high but the offer is unnecessary given AEAD alternatives are universally supported by every modern endpoint.
Remediation: Remove CBC cipher suites from the device's TLS ClientHello offer list. Keep only AEAD: TLS 1.3 (0x1301/02/03) and TLS 1.2 ECDHE-AEAD (0xc02c/2b/30/2f).
Effort: Easy
CVSS Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:NOWASP Web: A02:2021 Cryptographic Failures
NIST 800-53: SC-13, SC-8
MEDIUM PT-005 — DHCP Hostname Discloses Asset Identifier
Description: The device populates DHCP option 12 (Host Name) with an asset identifier (serial number, device tag) that is broadcast on every DHCP DISCOVER/REQUEST.
Impact: Any host on the broadcast domain can passively map the device's MAC and IP to the broadcast asset tag — vendor, model and serial are derivable without sending a single packet. Combined with mDNS reflection this is reflected across L3 boundaries.
Remediation: Replace DHCP Host Name with an opaque per-device identifier (UUID or salted hash). The true serial should only travel inside the encrypted device-to-cloud channel.
Effort: Easy
CVSS Vector:
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NOWASP Web: A01:2021 Broken Access Control
NIST 800-53: SC-7, PE-20, PL-8
MEDIUM PT-006 — DNS Search-Suffix Appended to Fully-Qualified Hostnames
Description: The device's DNS client appends the DHCP-supplied search domain to hostnames that are already fully-qualified. RFC 1535 and RFC 8767 require resolvers not to apply search-suffix processing to FQDNs.
Impact: An attacker controlling the search-suffix DNS zone can redirect the device's cloud traffic to attacker-controlled IPs. TLS server certificate validation usually catches the substitution, but the failure mode leaks connection metadata on every retry. If cert pinning is incorrectly implemented, the substitution succeeds.
Remediation: Patch device DNS client so hostnames with three or more labels (or trailing dot) bypass search-domain processing. Set 'ndots' threshold to 1.
Effort: Easy
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NOWASP Web: A04:2021 Insecure Design
NIST 800-53: SC-20, SI-10
HIGH PT-101 — SMBv1 Traffic Observed (EternalBlue / NotPetya exposure)
Description: SMBv1 protocol traffic observed between the device and one or more internal peers. SMBv1 is deprecated since 2014 and is the transport for EternalBlue (MS17-010) / WannaCry / NotPetya.
Impact: Active SMBv1 on a clinical network creates a worm propagation path. Disable per FDA Postmarket Cybersecurity Guidance and Joint Commission EHR-protection expectations.
Remediation: Disable SMBv1 on every host. Confirm SMB2+ minimum on file servers. Block 445/tcp at segmentation boundary.
Effort: Moderate
CVSS Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HOWASP Web: A05:2021 Security Misconfiguration
MITRE ATT&CK: T1210 (Lateral Movement)
NIST 800-53: CM-7, SI-2
CISA KEV
HIGH PT-102 — LLMNR / NBT-NS Name Resolution in Use (Responder Surface)
Description: LLMNR or NetBIOS Name Service broadcast-based name resolution is in use on the segment. These protocols are abused by Responder / Inveigh to poison name resolution and capture NTLMv2 hashes.
Impact: An attacker on the same broadcast domain runs `responder -I eth0` and captures hashes from any device that mistypes a hostname or uses a non-FQDN lookup. Hashes are crackable offline or relayed via ntlmrelayx for immediate authentication elsewhere (CVE-2019-1040 mitigations notwithstanding).
Remediation: Disable LLMNR (GPO: Turn Off Multicast Name Resolution = Enabled) and NBT-NS (Network adapter → WINS → Disable NetBIOS over TCP/IP). Block UDP/5355 and UDP/137 at every L3 boundary.
Effort: Moderate
CVSS Vector:
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NOWASP Web: A07:2021 Identification and Authentication Failures
MITRE ATT&CK: T1557.001 (Credential Access)
NIST 800-53: SC-7, CM-7, IA-3
LOW PT-103 — SSDP / UPnP Broadcasts Expose Internal Services
Description: SSDP/UPnP discovery traffic observed on the segment. SSDP advertises every UPnP-aware device (smart TVs, consumer routers, printers, NAS, IoT) on the local broadcast domain.
Impact: SSDP discovery reveals consumer-IoT, printers, smart TVs, NAS and router admin interfaces to anyone on the LAN. In a clinical network this co-mingles consumer devices with medical equipment and facilitates lateral discovery.
Remediation: Disable UPnP/SSDP on clinical-network hosts where not required. Block UDP/1900 at every L3 boundary.
Effort: Easy
CVSS Vector:
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:NOWASP Web: A05:2021 Security Misconfiguration
NIST 800-53: CM-7, SC-7
LOW PT-104 — mDNS Activity Exposes Device Identity on Internal Segment
Description: Device emits mDNS queries and/or responses on the local segment. mDNS exposes the device's hostname and services to any host on the multicast-reachable segment, and is reflected across L3 by mDNS-reflector-enabled gateways.
Impact: Device fingerprinting and asset enumeration without active probing. Reduces the cost of targeting a specific device for theft, social-engineering, or RF replay attack.
Remediation: Disable mDNS on the device if not required. Audit network-side mDNS reflector config (Avahi `reflector=yes`, UniFi 'Multicast DNS') and disable cross-VLAN reflection.
Effort: Easy
CVSS Vector:
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:NOWASP Web: A05:2021 Security Misconfiguration
NIST 800-53: CM-7
LOW PT-105 — LLDP Topology / Switch Firmware Disclosure
Description: LLDP TLVs observed on the segment leak switch identity, model and firmware. Information that downstream attackers can use to select vendor-specific CVEs.
Impact: An attacker passively learns the network gear vendor, model and firmware version without sending any probes. Combined with public CVE databases this is a free vulnerability-research head-start.
Remediation: Disable LLDP on access ports facing devices (`no lldp transmit` / `no lldp receive`). Keep LLDP only on inter-switch trunks.
Effort: Easy
CVSS Vector:
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:NOWASP Web: A01:2021 Broken Access Control
NIST 800-53: SC-7, CM-7
MEDIUM PT-106 — ARP Anomalies (Duplicate IP-to-MAC Mappings)
Description: Duplicate ARP entries observed — one IP advertised by multiple MAC addresses. Possible legitimate HA pair, gratuitous ARP storm, or active ARP-spoofing / MitM.
Impact: If the duplicate is a MitM attack, the attacker is intercepting traffic between the device and another host. Even when legitimate (HA failover), the unannounced duplicate breaks deterministic L2 routing and may drop packets.
Remediation: Investigate each duplicate. Configure DAI (Dynamic ARP Inspection) on managed switches. Bind static IP↔MAC for critical clinical-device subnets.
Effort: Moderate
CVSS Vector:
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LOWASP Web: A07:2021 Identification and Authentication Failures
MITRE ATT&CK: T1557.002 (Credential Access)
NIST 800-53: SC-7, SI-4
HIGH PT-107 — Cleartext FTP Traffic Observed (credentials in plaintext)
Description: FTP control-channel traffic observed in cleartext. FTP USER/PASS commands and file contents are passively captureable by any on-path observer.
Impact: Any L2 / SPAN / WiFi-sniffing attacker can capture FTP credentials and uploaded/downloaded file content. In a clinical setting this may include device firmware, calibration data, or PHI.
Remediation: Disable FTP. Use SFTP (SSH) or FTPS (FTP over TLS, explicit AUTH TLS). Block 21/tcp at segmentation boundary.
Effort: Moderate
CVSS Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NOWASP Web: A02:2021 Cryptographic Failures
NIST 800-53: SC-8, SC-13
HIGH PT-108 — Cleartext Telnet Traffic Observed
Description: Telnet traffic observed in cleartext. Telnet credentials and keystrokes are sent in plaintext and trivially captured by passive observers.
Impact: Full session capture — usernames, passwords and every keystroke are recoverable from a passive sniff. Common on legacy embedded and industrial-control devices.
Remediation: Replace Telnet with SSH. Block 23/tcp at every L3 boundary.
Effort: Moderate
CVSS Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NOWASP Web: A02:2021 Cryptographic Failures
NIST 800-53: SC-8, CM-7
MEDIUM PT-109 — SNMPv1/v2c Community String in Cleartext
Description: SNMP community strings (passwords) observed in plaintext. Communities like 'public' / 'private' / vendor-default values grant MIB-table read access (or write if RW).
Impact: SNMP community strings are passwords. An attacker capturing them can read MIB data (interface stats, ARP tables, routing tables) and with a write community can reconfigure the device.
Remediation: Migrate to SNMPv3 with authentication (SHA) + encryption (AES). Disable SNMPv1/v2c. Restrict SNMP source IPs at the device.
Effort: Moderate
CVSS Vector:
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NOWASP Web: A02:2021 Cryptographic Failures
NIST 800-53: SC-8, AC-3
HIGH PT-110 — HTTP Basic Authentication Observed in Cleartext
Description: HTTP Basic Auth headers observed in cleartext. Authorization: Basic <base64> is one base64-decode step away from username:password.
Impact: Basic Auth credentials are base64-encoded usernames+passwords. Any passive observer can decode them in one step (`base64 -d`). Often reused across many systems.
Remediation: Wrap the affected service in TLS (HTTPS) or replace Basic Auth with token/cookie-based scheme over TLS. Block plain HTTP on authenticated admin endpoints.
Effort: Moderate
CVSS Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NOWASP Web: A02:2021 Cryptographic Failures
NIST 800-53: SC-8, IA-5
MEDIUM PT-111 — LDAP Bind Observed Without TLS
Description: LDAP bind request observed in cleartext. Without LDAPS or StartTLS, the bind DN and password are exposed.
Impact: An attacker capturing the bind can extract the LDAP credentials. Domain-bound accounts are reusable across the AD forest and may unlock additional services (Kerberos, file shares, mail, VPN).
Remediation: Enforce LDAPS (TCP/636) or LDAP+StartTLS. Block plain LDAP (389/tcp) at the firewall.
Effort: Moderate
CVSS Vector:
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NOWASP Web: A02:2021 Cryptographic Failures
NIST 800-53: SC-8, IA-5