Title: KevinLAB BEMS 1.0 Undocumented Backdoor Account
Advisory ID: ZSL-2021-5654
Type: Local/Remote
Impact: System Access, DoS
Risk: (5/5)
Release Date: 20.07.2021

Summary

KevinLab is a venture company specialized in IoT, Big Data, A.I based energy management platform. KevinLAB's BEMS (Building Energy Management System) enables efficient energy management in buildings. It improves the efficient of energy use by collecting and analyzing various information of energy usage and facilities in the building. It also manages energy usage, facility efficiency and indoor environment control.

Description

The BEMS solution has an undocumented backdoor account and these sets of credentials are never exposed to the end-user and cannot be changed through any normal operation of the solution thru the RMI. Attacker could exploit this vulnerability by logging in using the backdoor account with highest privileges for administration and gain full system control. The backdoor user cannot be seen in the users settings in the admin panel and it also uses an undocumented privilege level (admin_pk=1) which allows full availability of the features that the BEMS is offering remotely.

Vendor

KevinLAB Inc. - http://www.kevinlab.com

Affected Version

4ST L-BEMS 1.0.0 (Building Energy Management System)

Tested On

Linux CentOS 7
Apache 2.4.6
Python 2.7.5
PHP 5.4.16
MariaDB 5.5.68

Vendor Status

[05.07.2021] Vulnerability discovered.
[08.07.2021] Vendor contacted.
[12.07.2021] No response from the vendor.
[13.07.2021] Vendor contacted.
[19.07.2021] No response from the vendor.
[20.07.2021] Public security advisory released.

PoC

kevinlab_bems_backdoor.txt

Credits

Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk>

References

[1] https://packetstormsecurity.com/files/163571/
[2] https://www.exploit-db.com/exploits/50145
[3] https://cxsecurity.com/issue/WLB-2021070124
[4] https://exchange.xforce.ibmcloud.com/vulnerabilities/205982
[5] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-37292

Changelog

[20.07.2021] - Initial release
[21.07.2021] - Added reference [1], [2] and [3]
[22.07.2021] - Added reference [4]
[11.04.2022] - Added reference [5]

Contact

Zero Science Lab

Web: https://www.zeroscience.mk
e-mail: lab@zeroscience.mk