Connected Dishwasher Has Security Smudge That Doesn’t Come Off

A network-connected dishwasher from German manufacturer Miele has been found to harbor a security vulnerability that would allow an unauthenticated attacker access to system files. The issue is now public and no fix is known, since the company failed to engage in a responsible vulnerability disclosure process with the researcher who found the bug.

Jens Regel of Schneider & Wulf discovered a “web server directory traversal” vulnerability in the Miele Professional PG 8528 dishwasher. The flaw can be exploited from the local network by connecting to the machine via telnet interface; an intruder with access to the file system could plant malware that would affect other devices on the network.

“The corresponding embedded webserver “PST10 WebServer” typically listens to port 80 and is prone to a directory traversal attack, therefore an unauthenticated attacker may be able to exploit this issue to access sensitive information to aide in subsequent attacks,” says Regel in the vulnerability report.

These machines are not supposed to be available over the Internet, but past reports teach us that this is actually almost never the case; such a dishwasher has a high likelihood of being accessible remotely.

According to the disclosure timeline, Regel talked to a Miele product representative on November 21, 2016, and sent details of the security issue in early December. The researcher says he has received no status update since, forcing him to publicly reveal the glitch. On the product’s page, the only downloads available are manuals with operating instructions.

Unfortunately, makers of smart things rarely consider their products’ security, or lack thereof, and focus mainly on functionality. This problem has been highlighted lately through warnings  from the security industry as well as governments. Although guidelines exist for a safer Internet of Things, very few manufacturers adopt them and only larger ones tackle the problem seriously and carry out security audits before their products hit the shelves.

Photo credit: PhotoMix for Pexels.