pCOWeb Security Misconfiguration Scanner

pCOWeb is a widely used web-based interface embedded in Carel pCO controllers, allowing users to monitor and control HVAC systems. It is employed across various industries, including commercial buildings, data centers, and industrial facilities. Maintenance teams and facility managers leverage pCOWeb for efficient system operation and energy management. The platform's ease of use and accessibility make it a popular choice for HVAC system control and monitoring. It supports remote management, enabling quick adjustments and troubleshooting. However, improper configuration can expose the system to vulnerabilities.

This scanner identifies vulnerabilities related to pCOWeb's unauthenticated access, where sensitive configurations can be accessed without proper authentication. Unauthenticated access signifies an inadequate authentication mechanism, risking exposure of sensitive information. This vulnerability can arise from default credentials or lack of authentication steps in web interfaces. It poses a significant risk, allowing unauthorized users to modify system settings. Identifying and remediating such vulnerabilities helps secure critical infrastructural systems. Proper configuration and access control are necessary to mitigate these risks.

The vulnerability specifically targets the pCOWeb system where the "/config/pw_left_bar.html" endpoint can be accessed without authentication. Successful exploitation allows retrieval of internal configuration data. The vulnerability manifests when default credentials or configurations are unchanged. This exposes systems to unauthorized changes and information leaks. The detection involves sending a specific HTTP GET request to the targeted endpoint. Confirmation of vulnerability is based on response status and content conditions.

Exploitation of unauthenticated access in pCOWeb can lead to severe consequences, including unauthorized control over HVAC systems. Malicious actors can alter system configurations, leading to potential operational disruptions. Exposure of sensitive system data compromises both security and privacy. Attackers can gain insights into network configurations and exploit further vulnerabilities. In a worst-case scenario, unauthorized access could lead to physical damage due to incorrect system settings. Continuous access to configuration data can also facilitate more advanced cyber attacks.

REFERENCES

• https://docs.librenms.org/Support/Device-Notes/Carel-pCOweb-Devices/#:~:text=Accessing%20the%20pCOWeb%20card,-Log%20on%20to&text=The%20default%20username%20and%20password%20is%20admin%2Ffadmin%20