modulinformation public visible
Answered
/api/modulinformation is exposed as public visible on port 7001. I think this should not be default as we can see internal network and more informations
-
Hi bytesitter,
Thank you for your message.
The endpoint is essential for system auto-discovery and general connectivity. It provides the data that allows the Desktop Client to detect and list all available Systems on the network.
None of the information isn't already publicly available, or cannot be exploited by itself
There are already established tools like Shodan and similar search engines that specialize in this kind of discovery, many of which offer APIs for automation. These platforms can be used to query not just our VMS, but virtually any well-known brand or device exposed to the internet. This is simply a part of how the internet operates today.
Even if certain data isn’t exposed via the API, identifying default ports (like 7001) is relatively straightforward. And even without specific knowledge of an application, anyone can use standard tools likenmapornetcatto perform a port scan on a public IP address. That said, having this kind of information, such as a System ID, does not pose a direct security risk. Knowing an ID alone doesn’t grant authentication or access to the system.
If your goal is to minimize potential exposure, a practical and effective approach would be to limit access to the VMS servers by restricting traffic to known IP addresses. This can be done by configuring a passlist on the network that allows connections over port 7001 (or any other configured port) only from trusted sources. When using the Nx Cloud, nobody needs a connection over port 7001 at all.This type of access control is a common best practice in corporate environments, not just for VMS, but also for printers, workstations, HVAC systems, and any other network-connected devices.
Best regards.
0
Please sign in to leave a comment.
Comments
1 comment