PT-2021-23880 · Knx Ets · Knx Ets

Published 2021-11-09 · Updated 2024-08-04 · CVE-2021-43575

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions KNX ETS versions 6.0.0 and earlier

Description The issue allows local users to read project information due to the use of a hard-coded password ETS5Password with a salt value of Ivan Medvedev. This is similar to a previously identified issue. The vendor disputes the responsibility of the ETS in securely storing cryptographic key material when it is not being exported.

Recommendations For KNX ETS versions 6.0.0 and earlier, consider changing the hard-coded password ETS5Password to a unique and secure password to prevent unauthorized access to project information. As a temporary workaround, restrict local access to the system to minimize the risk of exploitation.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2021-43575

Affected Products

Knx Ets

References · 6

• 🔥 https://github.com/robertguetzkow/ets5-password-recovery · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-43575 · Security Note
• https://osv.dev/vulnerability/CVE-2021-43575 · Vendor Advisory
• https://t.me/cibsecurity/32128 · Telegram Post
• https://t.me/cvenotify/88915 · Telegram Post
• https://t.me/cvenotify/23185 · Telegram Post