Detecting a series of vulnerabilities can help hackers disable metal detectors at airports

Taking advantage of these vulnerabilities, hackers can bypass authentication requests, forge detector configurations, and even execute arbitrary code on the device.

"An attacker can manipulate this module to remotely monitor metal detector statistics, such as whether alarms have been triggered or how many visitors have passed," the report said. by Cisco Talos revealed. "Hackers can also make configuration changes, such as changing device sensitivity, which can pose security risks to organizations that rely heavily on detectors. metal".

Detecting a series of vulnerabilities can help hackers disable metal detectors at airports Picture 1

Cisco Talos security researcher Matt Wiseman discovered and reported the vulnerabilities on August 17, 2021. Patches were released by the vendor on 12/13/2021.

The vulnerabilities reside in the Garrett iC Module, which allows operators to communicate with pass-through gate metal detectors such as the Garrett PD 6500i or Garrett MZ 6100 using a computer over a wired or wireless network. It allows operators to perform remote device operations and monitoring in real time.

Here is the list of newly disclosed vulnerabilities:

1. CVE-2021-21901 (CVSS score: 9.8), CVE-2021-21903 (CVSS score: 9.8), CVE-2021-21905 and CVE-2021-21906 (CVSS score: 8.2) - Vulnerability A stack-based buffer overflow can be triggered by sending a malicious packet to the device
2. CVE-2021-21902 (CVSS score: 7.5) - Authentication bypass vulnerability stemming from a rare condition, which can be triggered by sending a request string
3. CVE-2021-21904 (CVSS score: 9.1), CVE-2021-21907 (CVSS score: 4.9), CVE-2021-21908 and CVE-2021-21909 (CVSS score: 6.5) - Holes directory traversal vulnerability that can be exploited by sending specially crafted commands

By successfully exploiting the aforementioned vulnerabilities in the iC Module CMA version 5.0, an attacker can hijack an authenticated user's session, be able to read, write, or delete arbitrary files on the device and worse. is to lead to remote code execution.

Due to the severity of the vulnerabilities, units using metal detectors are advised to update the firmware to the latest version as soon as possible.

Marvin Fry

Update 28 December 2021