Executive Summary

This vulnerability involves WorkExaminer Professional transmitting all traffic between its monitoring client, console, and server in plain text without encryption. This means that an attacker who has access to the network can read sensitive data being transmitted and can also modify the data freely while it is in transit. Specifically, monitoring clients send data to the server using unencrypted FTP on port 12304, and all traffic between the console client and server on port 12306 is also unencrypted.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to unauthorized disclosure of sensitive information because data is transmitted in plain text and can be intercepted by attackers on the network. Additionally, attackers can modify the data in transit, potentially leading to data tampering, misinformation, or unauthorized control over monitoring data. This compromises the confidentiality and integrity of the data exchanged between clients, consoles, and servers.

Useful 0 Not Useful 0

Detection Guidance

You can detect this vulnerability by monitoring network traffic for unencrypted data transmissions on the specific ports used by WorkExaminer Professional. Specifically, check for unencrypted FTP traffic on port 12304 and unencrypted traffic between the console client and server on port 12306. Commands such as 'tcpdump -i <interface> port 12304 or port 12306' or 'wireshark' filters for these ports can help identify unencrypted data flows.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting network access to ports 12304 and 12306 to trusted hosts only, using network segmentation or firewall rules to limit exposure, and avoiding transmitting sensitive data over these unencrypted channels. Additionally, consider using VPNs or other encryption methods to protect data in transit until a secure update or patch is available.

Useful 0 Not Useful 0