Lucene search

[email protected]CVE-2023-0052

HistoryJan 20, 2023 - 10:15 p.m.

CVE-2023-0052

2023-01-2022:15:10

CWE-306

[email protected]

web.nvd.nist.gov

sauter controls

nova 200–220

firmware 3.3-006

bacnetstac 4.2.1

unauthorized access

command execution

telnet

ftp.

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

8.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

46.3%

JSON

SAUTER Controls Nova 200–220 Series with firmware version 3.3-006 and prior and BACnetstac version 4.2.1 and prior allows the execution of commands without credentials. As Telnet and file transfer protocol (FTP) are the only protocols available for device management, an unauthorized user could access the system and modify the device configuration, which could result in the unauthorized user executing unrestricted malicious commands.

Affected configurations

NVD

Node

sauter-controlsnova_220_eyk220f001Match-

AND

sauter-controlsnova_220_eyk220f001_firmwareRange≤3.3-006

Node

sauter-controlsnova_230_eyk230f001Match-

AND

sauter-controlsnova_230_eyk230f001_firmwareRange≤3.3-006

Node

sauter-controlsnova_106_eyk300f001Match-

AND

sauter-controlsnova_106_eyk300f001_firmwareRange≤3.3-006

Node

sauter-controlsmodunet300_ey-am300f001Match-

AND

sauter-controlsmodunet300_ey-am300f001_firmwareRange≤3.3-006

Node

sauter-controlsmodunet300_ey-am300f002Match-

AND

sauter-controlsmodunet300_ey-am300f002_firmwareRange≤3.3-006

CPENameOperatorVersion
sauter-controls:nova_220_eyk220f001_firmwaresauter-controls nova 220 eyk220f001 firmwarele3.3-006

CPE	Name	Operator	Version
sauter-controls:nova_220_eyk220f001_firmware	sauter-controls nova 220 eyk220f001 firmware	le	3.3-006

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Nova 220 (EYK220F001) DDC with BACnet connection",
    "vendor": "SAUTER Controls",
    "versions": [
      {
        "lessThanOrEqual": "3.3-006",
        "status": "affected",
        "version": "Firmware all versions",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.2.1",
        "status": "affected",
        "version": "BACnetstac all versions",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Nova 230 (EYK230F001) DDC with BACnet connection",
    "vendor": "SAUTER Controls",
    "versions": [
      {
        "lessThanOrEqual": "3.3-006",
        "status": "affected",
        "version": "Firmware all versions",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.2.1",
        "status": "affected",
        "version": "BACnetstac all versions",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Nova 106 (EYK300F001) BACnet communication card",
    "vendor": "SAUTER Controls",
    "versions": [
      {
        "lessThanOrEqual": "3.3-006",
        "status": "affected",
        "version": "Firmware all versions",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.2.1",
        "status": "affected",
        "version": "BACnetstac all versions",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "moduNet300 (EY-AM300F001, EY-AM300F002)",
    "vendor": "SAUTER Controls",
    "versions": [
      {
        "lessThanOrEqual": "3.3-006",
        "status": "affected",
        "version": "Firmware all versions",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.2.1",
        "status": "affected",
        "version": "BACnetstac all versions",
        "versionType": "custom"
      }
    ]
  }
]