CVE-2024-12013 Overview
CVE-2024-12013 affects the 130.8005 TCP/IP Gateway running firmware version 12h. The device exposes an FTP server protected by default and easily guessable administrator credentials. A remote attacker who reaches the FTP service can authenticate and modify sensitive resources, including configuration files that store password hashes and network settings. The weakness is categorized as [CWE-1392] Use of Default Credentials. The issue was published to NVD on February 13, 2025, with an advisory issued by Nozomi Networks Labs.
Critical Impact
Remote attackers with network reach to the FTP service can read and alter gateway configuration, extract stored password hashes, and pivot deeper into operational technology networks.
Affected Products
- 130.8005 TCP/IP Gateway (firmware version 12h)
- Deployments exposing the built-in FTP administrative service
- Environments where default credentials remain unchanged
Discovery Timeline
- 2025-02-13 - CVE-2024-12013 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-12013
Vulnerability Analysis
The 130.8005 TCP/IP Gateway ships with an FTP server that accepts default administrator credentials documented for the product. Because the credentials are static and predictable, any actor with network access to the FTP port can authenticate as an administrator. Once authenticated, the attacker can list, download, and overwrite files exposed by the service.
The most consequential files include the gateway configuration store, which contains password hashes for local accounts and network parameters such as IP addressing and routing. Retrieving these files enables offline password cracking against the stored hashes. Overwriting them allows the attacker to change the gateway's network behavior or plant persistent modifications. The impact combines authentication bypass in practice with configuration tampering, giving the flaw high integrity impact alongside limited confidentiality and availability effects.
Root Cause
The root cause is a design decision to ship the FTP administrative service with default credentials that are easy to guess and not required to be rotated at first boot. There is no enforced credential change workflow, so devices deployed with the factory image remain exploitable until an operator manually hardens the account.
Attack Vector
Exploitation is performed over the network against the FTP listener. The attacker connects to the FTP port, supplies the known default administrator credentials, and interacts with the file system exposed by the service. No user interaction is required, and the attack requires no prior foothold beyond routing access to the device. See the Nozomi Networks CVE-2024-12013 Advisory for product-specific details.
No verified public exploit code is available. The vulnerability mechanism is straightforward authentication using vendor-documented default credentials against the exposed FTP service.
Detection Methods for CVE-2024-12013
Indicators of Compromise
- Successful FTP USER/PASS authentication events on the gateway using the vendor default administrator account
- RETR or STOR operations targeting gateway configuration files that contain password hashes or network settings
- Unexpected modifications to gateway configuration or network parameters following FTP sessions
- FTP connections to the 130.8005 gateway sourced from unmanaged or non-engineering workstations
Detection Strategies
- Inspect network traffic for FTP sessions to the gateway and alert on authentication using default usernames.
- Baseline legitimate administrative sources and flag FTP logins from any other network segment.
- Correlate FTP file transfer commands with subsequent configuration changes on the device.
Monitoring Recommendations
- Forward gateway and network sensor logs to a centralized analytics platform for retention and correlation.
- Monitor for repeated FTP authentication attempts consistent with credential guessing.
- Track configuration file integrity and alert on unauthorized changes to files storing hashes or network settings.
How to Mitigate CVE-2024-12013
Immediate Actions Required
- Change the default FTP administrator credentials on every 130.8005 TCP/IP Gateway running firmware 12h.
- Restrict FTP access to a dedicated management VLAN and block the service from general corporate and internet routes.
- Audit gateway configuration files for unauthorized modifications and rotate any local account passwords whose hashes may have been exposed.
Patch Information
No vendor patch is referenced in the available advisory data. Consult the Nozomi Networks CVE-2024-12013 Advisory for the current remediation status and any firmware guidance from the device vendor.
Workarounds
- Disable the FTP service on the gateway if it is not required for operations.
- Place the device behind a firewall that permits FTP only from explicitly authorized administrative hosts.
- Replace FTP-based configuration workflows with an out-of-band management channel where the product supports it.
- Perform periodic credential audits to confirm default accounts have been removed or rotated across the fleet.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
