PT-2023-15973 · Sauter · Sauter Controls Nova 200–220 Series

Aarón Flecha Menéndez + 2 · Publicado 2023-01-16 · Atualizado 2023-10-27 · CVE-2023-0053

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAUTER Controls Nova 200–220 Series versions 3.3-006 and prior BACnetstac versions 4.2.1 and prior

Description The issue affects device management, where sensitive information such as credentials is sent in cleartext through FTP and Telnet protocols. An attacker could obtain this sensitive information to gain access to the system.

Recommendations For SAUTER Controls Nova 200–220 Series versions 3.3-006 and prior, consider disabling the use of FTP and Telnet protocols for device management until a secure alternative is available. For BACnetstac versions 4.2.1 and prior, restrict access to the system using FTP and Telnet to minimize the risk of exploitation. As a temporary workaround, avoid using cleartext protocols for communicating sensitive information, such as credentials, until a patch or secure alternative is available.

Correção

Cleartext Transmission of Sensitive Information

Enumeração de Fraquezas

CWE-319

Identificadores relacionados

CVE-2023-0053

Produtos afetados

Sauter Controls Nova 200–220 Series

Referências · 7

• https://t.me/echeloneyes/1082 · Publicação no Telegram
• https://t.me/cvenotify/45933 · Publicação no Telegram
• https://t.me/cibsecurity/59304 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-0053 · Nota de Segurança
• https://cisa.gov/uscert/ics/advisories/icsa-23-012-05 · Nota
• https://t.me/cvenotify/45323 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-0053 · Aviso do Fabricante