CVE-2023-0053

Summary

SAUTER Controls Nova 200–220 Series with firmware version 3.3-006 and prior and BACnetstac version 4.2.1 and prior have only FTP and Telnet available for device management. Any sensitive information communicated through these protocols, such as credentials, is sent in cleartext. An attacker could obtain sensitive information such as user credentials to gain access to the system.

Affected Software

VendorProductVersion RangeStatus
SAUTER ControlsNova 220 (EYK220F001) DDC with BACnet connectionFirmware all versions <= 3.3-006affected
SAUTER ControlsNova 220 (EYK220F001) DDC with BACnet connectionBACnetstac all versions <= 4.2.1affected
SAUTER ControlsNova 230 (EYK230F001) DDC with BACnet connectionFirmware all versions <= 3.3-006affected
SAUTER ControlsNova 230 (EYK230F001) DDC with BACnet connectionBACnetstac all versions <= 4.2.1affected
SAUTER ControlsNova 106 (EYK300F001) BACnet communication cardFirmware all versions <= 3.3-006affected
SAUTER ControlsNova 106 (EYK300F001) BACnet communication cardBACnetstac all versions <= 4.2.1affected
SAUTER ControlsmoduNet300 (EY-AM300F001, EY-AM300F002)Firmware all versions <= 3.3-006affected
SAUTER ControlsmoduNet300 (EY-AM300F001, EY-AM300F002)BACnetstac all versions <= 4.2.1affected

Weaknesses

  • CWE-319: CWE-319 Cleartext Transmission of Sensitive Information

Workarounds

SAUTER Controls has stated that this product line is no longer supported, as it was discontinued in 2016. SAUTER Controls recommends users take all necessary measures to protect the integrity of building automation network access, using all appropriate means and policies to minimize risks. Sauter Controls recommends users evaluate and upgrade legacy systems to current solutions where necessary.  

Affected users should contact SAUTER Controls https://www.sauter-controls.com/  for instructions on upgrading legacy systems.

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

References