Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2023-0052

SAUTER Controls Nova 200–220 Series Missing Authentication for Critical Function

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
icscert

Description

SAUTER Controls Nova 200–220 Series with firmware version 3.3-006 and prior and BACnetstac version 4.2.1 and prior allows the execution of commands without credentials. As Telnet and file transfer protocol (FTP) are the only protocols available for device management, an unauthorized user could access the system and modify the device configuration, which could result in the unauthorized user executing unrestricted malicious commands.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SAUTER Controls Nova 220 (EYK220F001) DDC with BACnet connection

Default version status: unaffected

  • Firmware all versions to ≤ 3.3-006affected
  • BACnetstac all versions to ≤ 4.2.1affected

SAUTER Controls Nova 230 (EYK230F001) DDC with BACnet connection

Default version status: unaffected

  • Firmware all versions to ≤ 3.3-006affected
  • BACnetstac all versions to ≤ 4.2.1affected

SAUTER Controls Nova 106 (EYK300F001) BACnet communication card

Default version status: unaffected

  • Firmware all versions to ≤ 3.3-006affected
  • BACnetstac all versions to ≤ 4.2.1affected

SAUTER Controls moduNet300 (EY-AM300F001, EY-AM300F002)

Default version status: unaffected

  • Firmware all versions to ≤ 3.3-006affected
  • BACnetstac all versions to ≤ 4.2.1affected

References