PT-2022-8583 · Bachmann Electronic · M-Base Controllers
Ron Brash
·
Published
2022-05-19
·
Updated
2022-06-08
·
CVE-2020-16231
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Bachmann Electronic M-Base Controllers version MSYS v1.06.14 and later
Description
The issue concerns the use of weak cryptography to protect device passwords in the affected controllers. This could allow an unauthenticated remote attacker to gain access to the password hashes when Security Level 0 is set, which is the default setting from the manufacturer. Additionally, Security Level 4 is susceptible to attacks if an authenticated remote attacker or an unauthenticated person with physical access to the device reads and decrypts the password.
Recommendations
For version MSYS v1.06.14 and later, consider changing the default Security Level 0 setting to a higher security level to minimize the risk of exploitation.
As a temporary workaround, restrict physical access to the device to prevent unauthenticated persons from reading and decrypting the password.
Avoid using Security Level 4 until the issue is resolved, as it is susceptible to attacks if the password is read and decrypted by an authenticated remote attacker or an unauthenticated person with physical access to the device.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
M-Base Controllers