Horizon Alert
Summary of the vulnerability and why it matters
This advisory concerns a critical security vulnerability in Newtec Celox UHD devices that allows unauthorized access. An attacker can bypass authentication mechanisms by manipulating network responses to gain elevated privileges, potentially leading to a complete compromise of the affected systems. The primary concern is to confirm if these devices are in use within your environment.
- Unauthorized access possible in specific devices.
- Confirms operational technology security risks.
- Assess and confirm relevance to our environment.
Attack Path
How an attacker could exploit the issue
An attacker with network access can target the device's service endpoint to intercept communication. By manipulating the responses during the login process, an attacker can bypass authentication and gain elevated privileges. This could allow unauthorized control over the device.
- Network access required.
- Intercept and modify login responses.
- Unauthorized access and control.
Live Threat
Current exploitation, exposure, and threat context
When supported by the advisory, unauthorized Superuser or Operator access could be obtained on affected Newtec Celox UHD devices. This could occur by an attacker intercepting and modifying network responses to the `/celoxservice` endpoint during the `loginWithUserName` process.
- Device administrative access.
- Intercepting and forging network responses.
- Unauthorized control over device functions.
Operational Fix
Recommended remediation, mitigation, and detection steps
Newtec Celox UHD devices used for satellite and broadcast communications are likely to be managed remotely. The first step is to locate all instances of these devices, assess their exposure and criticality, and identify the accountable team responsible for remediation.
- Identify and confirm affected devices.
- Verify network exposure and business criticality.
- Plan vendor coordination for updates.
