CVE-2023-0053
SAUTER Controls Nova 200–220 Series Cleartext Transmission of Sensitive Information
- State
- Published
- Severity
- 7.5 High
- Published
- Mar 2, 2023
- Updated
- Jan 16, 2025
- Reserved
- Jan 4, 2023
Description
SAUTER Controls Nova 200–220 Series with firmware version 3.3-006 and prior and BACnetstac version 4.2.1 and prior have only FTP and Telnet available for device management. Any sensitive information communicated through these protocols, such as credentials, is sent in cleartext. An attacker could obtain sensitive information such as user credentials to gain access to the system.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | icscert |
Weaknesses
- CWE-319 Cleartext Transmission of Sensitive Information
Affected Products
| Product | Versions |
|---|---|
Nova 220 (EYK220F001) DDC with BACnet connectionSAUTER Controls |
|
Nova 230 (EYK230F001) DDC with BACnet connectionSAUTER Controls |
|
Nova 106 (EYK300F001) BACnet communication cardSAUTER Controls |
|
moduNet300 (EY-AM300F001, EY-AM300F002)SAUTER Controls |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.