PT-2021-11616 · Abus · Abus Secvest

Published 2021-04-20 · Updated 2021-04-27 · CVE-2020-28973

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: ABUS Secvest wireless alarm system version 3.01.17

Description: The issue allows unauthorized access to sensitive information, including usernames and passwords, due to improper authentication of requests to the built-in HTTPS interface. This sensitive information can be used to reconfigure or disable the alarm system.

Recommendations: For version 3.01.17, consider restricting access to the HTTPS interface until a patch is available. As a temporary workaround, limit the exposure of the alarm system to the internet to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2020-28973

Affected Products

Abus Secvest

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-28973 · Security Note
• https://osv.dev/vulnerability/CVE-2020-28973 · Vendor Advisory
• https://t.me/secharvester/10902 · Telegram Post
• https://eye.security/en/blog/breaking-abus-secvest-internet-connected-alarm-systems-cve-2020-28973 · Note