Description
The Auto-Maskin DCU 210E, RP-210E, and Marine Pro Observer Android App use an embedded webserver that uses unencrypted plaintext for the transmission of the administrator PIN Impact: An attacker once authenticated can change configurations, upload new configuration files, and upload executable code via file upload for firmware updates. Requires access to the network. Affected releases are Auto-Maskin DCU-210E, RP-210E, and the Marine Pro Observer Android App. Versions prior to 3.7 on ARMv7.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Auto-Maskin | DCU-210E | 3.7 – < 3.7 | 3.7 |
| Auto-Maskin | RP-210E | 3.7 – < 3.7 | 3.7 |
Advisories 1
- ICSA-20-051-04 Auto-Maskin RP210E, DCU210E, and Marine Observer Pro (Android App) CISA ICS & IT advisories · Feb 20, 2020
References
- VU#176301 third-party-advisory
- https://www.us-cert.gov/ics/advisories/icsa-20-051-04