Skip to content
OpenAdvisories
Critical ICSA-20-051-04 6 CVEs

Auto-Maskin RP210E, DCU210E, and Marine Observer Pro (Android App)

Published Feb 20, 2020 · Updated Feb 20, 2020

Vendor: Auto-Maskin Product: DCU210E Product: RP210E

Summary

Successful exploitation of these vulnerabilities could allow a remote attacker to gain root access to the underlying operating system of the device and may allow read/write access.

Vulnerabilities 6

  • Critical 9.4
    CVE-2018-5399

    The Auto-Maskin DCU 210E firmware contains an undocumented Dropbear SSH server, v2015.55, configured to listen on Port 22 while the DCU is running and is configured with a hard-coded credentials

    The Auto-Maskin DCU 210E firmware contains an undocumented Dropbear SSH server, v2015.55, configured to listen on Port 22 while the DCU is running. The Dropbear server is configured with a hard-coded user name and password combination of root / amroot. The se…

    Auto-Maskin RP-210E DCU-210E
  • Critical 9.1
    CVE-2018-5400

    The Auto-Maskin DCU 210E, RP-210E, and Marine Pro Observer Android App utilize an undocumented custom protocol to set up Modbus communications with other devices without validating those devices, resulting in an origin validation error

    The Auto-Maskin products utilize an undocumented custom protocol to set up Modbus communications with other devices without validating those devices. The originating device sends a message in plaintext, 48:65:6c:6c:6f:20:57:6f:72:6c:64, "Hello World" over UDP…

    Auto-Maskin DCU-210E RP-210E Marine Pro Observer Android App Android
  • Critical 9.1
    CVE-2018-5401

    The Auto-Maskin DCU 210E, RP-210E, and Marine Pro Observer Android App transmit sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors

    The Auto-Maskin DCU 210E, RP-210E, and Marine Pro Observer Android App transmit sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors. The devices transmit process control information via unencr…

    Auto-Maskin RP-210E DCU-210E Marine Pro Observer Android App Android
  • Critical 9.1
    CVE-2018-5402

    The Auto-Maskin DCU 210E, RP-210E, and Marine Pro Observer Android App use an embedded webserver that uses unencrypted plaintext for the transmission of the administrator PIN

    The Auto-Maskin DCU 210E, RP-210E, and Marine Pro Observer Android App use an embedded webserver that uses unencrypted plaintext for the transmission of the administrator PIN Impact: An attacker once authenticated can change configurations, upload new configu…

    Auto-Maskin DCU-210E RP-210E
  • Unscored —
    CVE-2019-6558

    In Auto-Maskin RP210E Versions 3.7 and prior, DCU210E Versions 3.7 and prior and Marine Observer Pro (Android App), the…

    Android
  • Unscored —
    CVE-2019-6560

    In Auto-Maskin RP210E Versions 3.7 and prior, DCU210E Versions 3.7 and prior and Marine Observer Pro (Android App), the…

    Android

Revision history

  1. #1

    ICSA-20-051-04 Auto-Maskin RP210E, DCU210E, and Marine Observer Pro (Android App)

References