Security researchers have found various critical vulnerabilities in Modbus gateways built by Advantech , that are used for serial connection of devices in industrial control environments to IP networks.
There have been hard - coded SSH keys in Advantech EKI series of devices , buffer overflow and code injection flaws in the same product.
There are two critical flaws Shellshock and Heartbleed in bash shell and OpenSSL ,to which EKI -1322 GPRS Ip gateway device is vulnerable, Researchers of Rapid 7 have confirmed .
Patches for Shellshock and Heartbleed for Bash shell and OpenSSL library were released immediately , but Advantech failed to apply those patches on device and moreover kept its silence on Rapid 7's disclosure .
Chief Researcher of Rapid 7 showed his concern on vulnerabilities by saying there have been previous similar kind of security bugs for SSH keys and still Shellshock bug was not looked upon after doing all the reverse engineering .
Rapid 7 has also found security issues in the DHCP client version 1..3.20-p10 product which had stack based buffer overflow . But they were not sure of the vulnerabilty to exploit for that.
After disclosure of hard coded SSH keys , Advantech and ICS -CERT warned about hardcoded SSH keys in the product EKI-122x series and they told the firmwares about the fix.
SSH hard coded keys were found in :
EKI-136* product line prior to firmware version 1.27,
EKI-132* product line prior to firmware version 1.98, and
EKI-122*-BE product line prior to firmware version 1.65.
There have been few more vulnerabilities exposed while Moore found out about SSH configuration , the keys were not being generated on the fly while Dropbear SSH client was being used to generate keys .