CVE-2023-0053

· HIGHModified

← All CVEs

CVSS v3.1

7.5

EPSS

0.39%

Published

Mar 1, 2023

Modified

Nov 21, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

SAUTER Controls Nova 200–220 Series with firmware version 3.3-006 and prior and BACnetstac version 4.2.1 and prior have only FTP and Telnet available for device management. Any sensitive information communicated through these protocols, such as credentials, is sent in cleartext. An attacker could obtain sensitive information such as user credentials to gain access to the system.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-319CWE-319

Affected Products (11)

sauter-controls · nova_220_eyk220f001_firmwarevulnerable

sauter-controls · nova_220_eyk220f001

sauter-controls · nova_230_eyk230f001_firmwarevulnerable

sauter-controls · nova_230_eyk230f001

sauter-controls · nova_106_eyk300f001_firmwarevulnerable

sauter-controls · nova_106_eyk300f001

sauter-controls · modunet300_ey-am300f001_firmwarevulnerable

sauter-controls · modunet300_ey-am300f001

sauter-controls · modunet300_ey-am300f002_firmwarevulnerable

sauter-controls · modunet300_ey-am300f002

sauter-controls · bacnetstacvulnerable

References (2)

https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-05

Third Party AdvisoryUS Government Resource

https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-05

Third Party AdvisoryUS Government Resource

KEV Catalog EPSS Scores Vendors All CVEs