CVE-2021-34573

In Enbra EWM in Version 1.7.29 together with several tested wireless M-Bus Sensors the events backflow and "no flow" are not reconized or misinterpreted. This may lead to wrong values and missing events...

Code injection

Enbra EWM 1.7.29 does not check for or detect replay attacks sent by wireless M-Bus Security mode 5 devices. Instead timestamps of the sensor are replaced by the time of the readout even if the data is a replay of earlier data...

Buffer overflow

In Enbra EWM in Version 1.7.29 together with several tested wireless M-Bus Sensors the events backflow and "no flow" are not reconized or misinterpreted. This may lead to wrong values and missing events...

Hardcoded credentials

Multiple Wireless M-Bus devices by Enbra use Hard-coded Credentials in Security mode 5 without an option to change the encryption key. An adversary can learn all information that is available in Enbra EWM...

CVE-2021-34573 Incorrect calculation in Enbra EWM does not report backflows or no flow events

In Enbra EWM in Version 1.7.29 together with several tested wireless M-Bus Sensors the events backflow and "no flow" are not reconized or misinterpreted. This may lead to wrong values and missing events...

CVE-2021-34573

CVE-2021-34573 affects Enbra EWM v1.7.29. Multiple external records (CNVD/CNNVD, CVE lists) describe an access control error wherein event returns and the “No flow”/backflow events are not re-recognized or are misinterpreted when used with several wireless M-Bus sensors. This can lead to incor...

CVE-2021-34572 Insufficient Verification of Data Authenticity in Enbra EWM (replay attack)

Enbra EWM 1.7.29 does not check for or detect replay attacks sent by wireless M-Bus Security mode 5 devices. Instead timestamps of the sensor are replaced by the time of the readout even if the data is a replay of earlier data...

CVE-2021-34572

Summary (CVE-2021-34572): Enbra EWM 1.7.29 is vulnerable to data forgery via replay attacks from wireless M-Bus Secure Mode 5 devices. The software does not check or detect replayed data; sensor timestamps are replaced with the readout time, enabling potential integrity issues. Affected component...

CVE-2021-34571

The CVE-2021-34571 entry concerns Enbra EWM, a universal Enbra Wireless M-Bus reading device. Concrete details across connected records show a trust/credential management issue in which several wireless M-Bus devices use hard-coded credentials in secure mode 5, with no option to change the encryp...

CVE-2021-34571 Hard-coded Credentials in Enbra Wireless M-Bus devices

Multiple Wireless M-Bus devices by Enbra use Hard-coded Credentials in Security mode 5 without an option to change the encryption key. An adversary can learn all information that is available in Enbra EWM...

Enbra EWM 安全漏洞

Enbra Ewm is a universal reading device from the Czech company Enbra. It uses a radio to read water meters, heating cost indicators and calorimeters. An access control error vulnerability exists in Enbra EWM version 1.7.29, which originates in Enbra EWM and several tested wireless M-Bus sensors,...

SSID Stripping flaw lets hackers mimic real wireless access points

By Deeba Ahmed SSID Stripping has emerged as a significant threat because it impacts major platforms like MS Windows, macOS, Apple iOS, Ubuntu, and Android. This is a post from HackRead.com Read the original post: SSID Stripping flaw lets hackers mimic real wireless access points...

PT-2021-6972 · Microsoft · Windows Wlan Autoconfig Service +1

Name of the Vulnerable Software and Affected Versions: Windows WLAN AutoConfig Service versions affected versions not specified Description: The issue is related to a lack of protection for service data in the Windows WLAN AutoConfig service of the Microsoft Windows operating system. This allows ...

PT-2021-6337 · Microsoft · Windows Wlan Autoconfig Service +1

Name of the Vulnerable Software and Affected Versions: Windows WLAN AutoConfig Service affected versions not specified Description: The issue is related to insufficient access restrictions in the Windows WLAN AutoConfig Service, which can be exploited to elevate privileges. This allows an attacke...

Microsoft Windows WLAN Auto Config Service 代码注入漏洞

The Microsoft Windows WLAN AutoConfig Service is a wireless network card configuration service for Windows Vista and above operating systems from Microsoft Corporation USA. A code injection vulnerability exists in Microsoft Windows WLAN Auto Config Service. The following products and versions are...

Lightning Cable with Embedded Eavesdropping

Normal-looking cables USB-C, Lightning, and so on that exfiltrate data over a wireless network. I blogged about a previous prototype here...

Tracking People by their MAC Addresses

Yet another article on the privacy risks of static MAC addresses and always-on Bluetooth connections. This one is about wireless headphones. The good news is that product vendors are fixing this: Several of the headphones which could be tracked over time are for sale in electronics stores, but...

Aruba Operating System Command Injection Vulnerability (CNVD-2021-77606)

Aruba Operating System is an operating system for wireless LANs and Aruba mobile controllers managed by Aruba Networks, Inc. The Aruba Operating System is vulnerable to command injection, which could be exploited by attackers to execute remote commands...

Huawei HarmonyOS 处理逻辑错误漏洞

Huawei HarmonyOS is an operating system from Huawei, China. It provides a microkernel-based, fully distributed operating system. Huawei HarmonyOS is vulnerable to a processing logic error that could be exploited by an attacker to cause a WLAN denial of service...

Aruba Operating System Buffer Overflow Vulnerability

Aruba Operating System, the operating system for Aruba controller-managed wireless LANs and Aruba mobile controllers from Aruba Networks, has a buffer overflow vulnerability that results from a boundary error when the system processes PAPI messages. error when processing PAPI messages. A remote...