Lucene search

[email protected]CVE-2023-0053

HistoryMar 02, 2023 - 1:15 a.m.

CVE-2023-0053

2023-03-0201:15:11

CWE-319

[email protected]

web.nvd.nist.gov

sauter controls

nova series

firmware

bacnetstac

cleartext credentials

vulnerability

security

ftp

telnet

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

48.9%

JSON

SAUTER Controls Nova 200–220 Series with firmware version 3.3-006 and
prior and BACnetstac version 4.2.1 and prior have only FTP and Telnet
available for device management. Any sensitive information communicated
through these protocols, such as credentials, is sent in cleartext. An
attacker could obtain sensitive information such as user credentials to
gain access to the system.

Affected configurations

NVD

Node

sauter-controlsnova_220_eyk220f001Match-

AND

sauter-controlsnova_220_eyk220f001_firmwareRange≤3.3-006

Node

sauter-controlsnova_230_eyk230f001Match-

AND

sauter-controlsnova_230_eyk230f001_firmwareRange≤3.3-006

Node

sauter-controlsnova_106_eyk300f001_firmwareRange≤3.3-006

AND

sauter-controlsnova_106_eyk300f001Match-

Node

sauter-controlsmodunet300_ey-am300f001_firmwareRange≤3.3-006

AND

sauter-controlsmodunet300_ey-am300f001Match-

Node

sauter-controlsmodunet300_ey-am300f002_firmwareRange≤3.3-006

AND

sauter-controlsmodunet300_ey-am300f002Match-

Node

sauter-controlsbacnetstacRange≤4.2.1

CPENameOperatorVersion
sauter-controls:nova_220_eyk220f001_firmwaresauter-controls nova 220 eyk220f001 firmwarele3.3-006

CPE	Name	Operator	Version
sauter-controls:nova_220_eyk220f001_firmware	sauter-controls nova 220 eyk220f001 firmware	le	3.3-006

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Nova 220 (EYK220F001) DDC with BACnet connection",
    "vendor": "SAUTER Controls",
    "versions": [
      {
        "lessThanOrEqual": "3.3-006",
        "status": "affected",
        "version": "Firmware all versions",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.2.1",
        "status": "affected",
        "version": "BACnetstac all versions",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Nova 230 (EYK230F001) DDC with BACnet connection",
    "vendor": "SAUTER Controls",
    "versions": [
      {
        "lessThanOrEqual": "3.3-006",
        "status": "affected",
        "version": "Firmware all versions",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.2.1",
        "status": "affected",
        "version": "BACnetstac all versions",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Nova 106 (EYK300F001) BACnet communication card",
    "vendor": "SAUTER Controls",
    "versions": [
      {
        "lessThanOrEqual": "3.3-006",
        "status": "affected",
        "version": "Firmware all versions",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.2.1",
        "status": "affected",
        "version": "BACnetstac all versions",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "moduNet300 (EY-AM300F001, EY-AM300F002)",
    "vendor": "SAUTER Controls",
    "versions": [
      {
        "lessThanOrEqual": "3.3-006",
        "status": "affected",
        "version": "Firmware all versions",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.2.1",
        "status": "affected",
        "version": "BACnetstac all versions",
        "versionType": "custom"
      }
    ]
  }
]