Skip to content
OpenAdvisories
Critical VDE-2022-061 1 CVE

VARTA: Multiple devices prone to hard-coded credentials

Published Mar 15, 2023 · Updated Mar 15, 2023

Vendor: VARTA Product: Element backup Product: Element S1 Product: Element S2 Product: Element S3 Product: Element S4 Product: One L/XL Product: Pulse (not pulse neo)

Summary

VARTA energy storage systems have a web user interface via which users and installers can access live data measurements and configure the system to their needs. It has been discovered that the corresponding credentials are hard-coded within the frontend and thus potentially exploitable.

Details

Impact
The vulnerability allows unauthorized read and write access to the web backend. This allows reading and writing of parameters that are not intended for this purpose (e.g. connectivity settings, grid parameters). This can impact the operational availability and integrity. The safety of the battery storage device is not affected because safety relevant parameters are not accessible via the web backend.

Mitigation
General countermeasures: Restrict HTTP traffic to the energy storage system by using an inbound firewall or other measures on the network level.

Remediation
A fixed version will be rolled out OTA as soon as it is available. Rollout for VARTA element backup will start end of Q1/2023 followed by Element S4.

Vulnerabilities 1

Revision history

  1. #1

    Initial revision.

References