A security engineer inspects a vulnerability scan report and port listing for a building automation system (BAS) controller deployed on an internal VLAN (172.16.45.10):
PORT STATE SERVICE REASON
23/tcp open telnet Unencrypted interactive management shell
80/tcp open http Embedded Web Server (Cleartext HTTP Basic Auth)
502/tcp open modbus Modbus TCP (Industrial protocol without built-in authentication)
Which of the following architectural and host vulnerabilities are present on this system? (Select TWO.)
- Transmission of management credentials and administrative traffic across unencrypted communication protocolsCevap
- BSQL injection vulnerability within the web server allowing unauthorized database query manipulation
- Exposure of unauthenticated operational technology protocols directly accessible on the networkCevap
- DMisclassification of a detective intrusion detection control as a preventive access control mechanism
- EApplication of host-based firewall rules to mitigate memory corruption and buffer overflow flaws
Cevap
The correct vulnerabilities are the transmission of management credentials across unencrypted communication protocols and the exposure of unauthenticated operational technology protocols directly accessible on the network.
The system exhibits two primary vulnerabilities: legacy unencrypted protocols (Telnet and HTTP) that transmit session data and administrative credentials in plaintext, and the deployment of Modbus TCP on port 502, an industrial control system protocol that inherently lacks native authentication mechanisms.
Adım Adım Çözüm
Anahtar Kavram
Host and Network Vulnerabilities in Cleartext Services and Legacy ICS Protocols