CVE-2023-0052

🗓️ 20 Jan 2023 21:23:08Reported by icscertType

SAUTER Controls Nova 200–220 Series firmware 3.3-006 and prior BACnetstac 4.2.1 and prior allows unauthorized commands execution

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2023-0052	21 Jan 202300:22	–	circl
CNNVD	Sauter AG Controls Nova 访问控制错误漏洞	13 Jan 202300:00	–	cnnvd
Cvelist	CVE-2023-0052 SAUTER Controls Nova 200–220 Series Missing Authentication for Critical Function	20 Jan 202321:23	–	cvelist
EUVD	EUVD-2023-12155	3 Oct 202520:07	–	euvd
ICS	SAUTER Controls Nova 200 - 220 Series (PLC 6)	12 Jan 202300:00	–	ics
NVD	CVE-2023-0052	20 Jan 202322:15	–	nvd
OSV	CVE-2023-0052	20 Jan 202322:15	–	osv
Prion	Design/Logic Flaw	20 Jan 202322:15	–	prion
Positive Technologies	PT-2023-7518 · Sauter · Sauter Controls Nova 106 +2	12 Jan 202300:00	–	ptsecurity
The Hacker News	CISA Warns of Flaws Affecting Industrial Control Systems from Major Manufacturers	16 Jan 202310:47	–	thn

NVD

Vulners

Node

sauter-controls nova_220_eyk220f001_firmwareRange≤3.3-006

AND

sauter-controls nova_220_eyk220f001Match-

Node

sauter-controls nova_230_eyk230f001_firmwareRange≤3.3-006

AND

sauter-controls nova_230_eyk230f001Match-

Node

sauter-controls nova_106_eyk300f001_firmwareRange≤3.3-006

AND

sauter-controls nova_106_eyk300f001Match-

Node

sauter-controls modunet300_ey-am300f001_firmwareRange≤3.3-006

AND

sauter-controls modunet300_ey-am300f001Match-

Node

sauter-controls modunet300_ey-am300f002_firmwareRange≤3.3-006

AND

sauter-controls modunet300_ey-am300f002Match-

[
  {
    "defaultStatus": "unaffected",
    "product": "Nova 220 (EYK220F001) DDC with BACnet connection",
    "vendor": "SAUTER Controls",
    "versions": [
      {
        "lessThanOrEqual": "3.3-006",
        "status": "affected",
        "version": "Firmware all versions",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.2.1",
        "status": "affected",
        "version": "BACnetstac all versions",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Nova 230 (EYK230F001) DDC with BACnet connection",
    "vendor": "SAUTER Controls",
    "versions": [
      {
        "lessThanOrEqual": "3.3-006",
        "status": "affected",
        "version": "Firmware all versions",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.2.1",
        "status": "affected",
        "version": "BACnetstac all versions",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Nova 106 (EYK300F001) BACnet communication card",
    "vendor": "SAUTER Controls",
    "versions": [
      {
        "lessThanOrEqual": "3.3-006",
        "status": "affected",
        "version": "Firmware all versions",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.2.1",
        "status": "affected",
        "version": "BACnetstac all versions",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "moduNet300 (EY-AM300F001, EY-AM300F002)",
    "vendor": "SAUTER Controls",
    "versions": [
      {
        "lessThanOrEqual": "3.3-006",
        "status": "affected",
        "version": "Firmware all versions",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.2.1",
        "status": "affected",
        "version": "BACnetstac all versions",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
cisa	www.cisa.gov/uscert/ics/advisories/icsa-23-012-05

21 Nov 2024 07:36Current

9.2High risk

Vulners AI Score9.2

CVSS 3.18.8 - 9.8

EPSS0.00255

SSVC

CWE-306