Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2023-0053

SAUTER Controls Nova 200–220 Series Cleartext Transmission of Sensitive Information

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
icscert

Description

SAUTER Controls Nova 200–220 Series with firmware version 3.3-006 and prior and BACnetstac version 4.2.1 and prior have only FTP and Telnet available for device management. Any sensitive information communicated through these protocols, such as credentials, is sent in cleartext. An attacker could obtain sensitive information such as user credentials to gain access to the system.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SAUTER Controls Nova 220 (EYK220F001) DDC with BACnet connection

Default version status: unaffected

  • Firmware all versions to ≤ 3.3-006affected
  • BACnetstac all versions to ≤ 4.2.1affected

SAUTER Controls Nova 230 (EYK230F001) DDC with BACnet connection

Default version status: unaffected

  • Firmware all versions to ≤ 3.3-006affected
  • BACnetstac all versions to ≤ 4.2.1affected

SAUTER Controls Nova 106 (EYK300F001) BACnet communication card

Default version status: unaffected

  • Firmware all versions to ≤ 3.3-006affected
  • BACnetstac all versions to ≤ 4.2.1affected

SAUTER Controls moduNet300 (EY-AM300F001, EY-AM300F002)

Default version status: unaffected

  • Firmware all versions to ≤ 3.3-006affected
  • BACnetstac all versions to ≤ 4.2.1affected

References