Ron Brash

**Name of the Vulnerable Software and Affected Versions** Baker Hughes Bentley Nevada 3500 System 1 6.x versions 6.98 and prior Baker Hughes Bentley Nevada 3500 System 1 versions 21.1 HF1 and prior Baker Hughes Bentley Nevada 3500 Rack Configuration versions 6.4 and prior Baker Hughes Bentley Nevada 3500/22M Firmware versions 5.05 and prior **Description** The affected products utilize a weak encryption algorithm for storage and transmission of sensitive data, which may allow an attacker to more easily obtain credentials used for access. **Recommendations** For Baker Hughes Bentley Nevada 3500 System 1 6.x versions 6.98 and prior, consider updating to a version that utilizes a stronger encryption algorithm. For Baker Hughes Bentley Nevada 3500 System 1 versions 21.1 HF1 and prior, consider updating to a version that utilizes a stronger encryption algorithm. For Baker Hughes Bentley Nevada 3500 Rack Configuration versions 6.4 and prior, consider updating to a version that utilizes a stronger encryption algorithm. For Baker Hughes Bentley Nevada 3500/22M Firmware versions 5.05 and prior, consider updating to a version that utilizes a stronger encryption algorithm. As a temporary workaround, consider restricting access to sensitive data until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Bachmann Electronic M-Base Controllers version MSYS v1.06.14 and later **Description** The issue concerns the use of weak cryptography to protect device passwords in the affected controllers. This could allow an unauthenticated remote attacker to gain access to the password hashes when Security Level 0 is set, which is the default setting from the manufacturer. Additionally, Security Level 4 is susceptible to attacks if an authenticated remote attacker or an unauthenticated person with physical access to the device reads and decrypts the password. **Recommendations** For version MSYS v1.06.14 and later, consider changing the default Security Level 0 setting to a higher security level to minimize the risk of exploitation. As a temporary workaround, restrict physical access to the device to prevent unauthenticated persons from reading and decrypting the password. Avoid using Security Level 4 until the issue is resolved, as it is susceptible to attacks if the password is read and decrypted by an authenticated remote attacker or an unauthenticated person with physical access to the device. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DA50N (affected versions not specified) **Description** The issue is related to weak password requirements on the web interface of the DA50N device. This weakness can be exploited remotely via HTTP or HTTPS, allowing an attacker to gain full access to the device. Once access is obtained, other passwords can be changed. Additionally, weak passwords on Linux accounts can be accessed via SSH or Telnet, with SSH being enabled by default on trusted interfaces. Although the SSH service does not support root login, a user can elevate to root access using the `su` command if they have the associated password. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DA50N (affected versions not specified) **Description** The issue is related to insufficient protection of registration data in the web interface, which may allow a remote attacker to gain unauthorized access to protected information. A malicious actor having access to the exported configuration file may obtain the stored credentials and thereby gain access to the protected resource. If the same passwords were used for other resources, further such assets may be compromised. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DA50N (affected versions not specified) **Description** The issue is related to insufficient authentication of data in the web interface, which may allow a remote attacker to execute arbitrary code by uploading a specially crafted image. Authorized users may inadvertently install a maliciously modified package file when updating the device via the web user interface, potentially using a package file obtained from an unauthorized source or a file that was compromised between download and deployment. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.