Summary
Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to gain access to the password hashes of the controller if Security Level 4 is not in use as recommended. In the recommended Security Level 4 setting, an authenticated remote attacker could get access to user credentials.
Vulnerabilities 1
-
High 7.2
All Bachmann M1 System Processor Modules - Use of Password Hash with Insufficient Computational Effort
The affected Bachmann Electronic M-Base Controllers of version MSYS v1.06.14 and later use weak cryptography to protect device passwords. Affected controllers that are actively supported include MX207, MX213, MX220, MC206, MC212, MC220, and MH230 hardware con…
Revision history
-
#2
ICSA-21-026-02 Bachmann M1 System Processor Modules (Update A)
-
#1
ICSA-21-026-02P All Bachmann M1 System Processor Modules
References
-
ICS Advisory ICSA-21-026-02 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-21-026-02
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://us-cert.cisa.gov/ics/tips/ICS-TIP-12-146-01B