CVEvulnerability

CVE-2020-16231

8.8 HIGH Published 2022-05-19 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-05-19
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
Weaknesses
CWE-916

Description

The affected Bachmann Electronic M-Base Controllers of version MSYS v1.06.14 and later use weak cryptography to protect device passwords. Affected controllers that are actively supported include MX207, MX213, MX220, MC206, MC212, MC220, and MH230 hardware controllers, and affected end-of-life controller include MC205, MC210, MH212, ME203, CS200, MP213, MP226, MPC240, MPC265, MPC270, MPC293, MPE270, and CPC210 hardware controllers. Security Level 0 is set at default from the manufacturer, which could allow an unauthenticated remote attacker to gain access to the password hashes. Security Level 4 is susceptible if an authenticated remote attacker or an unauthenticated person with physical access to the device reads and decrypts the password to conduct further attacks.

Affected configurations

• bachmann mx207 firmware (>= 1.06.14) • bachmann mx213 firmware (>= 1.06.14) • bachmann mx220 firmware (>= 1.06.14) • bachmann mc206 firmware (>= 1.06.14) • bachmann mc212 firmware (>= 1.06.14) • bachmann mc220 firmware (>= 1.06.14) • bachmann mh230 firmware (>= 1.06.14) • bachmann mc205 firmware (>= 1.06.14) • bachmann mc210 firmware (>= 1.06.14) • bachmann mh212 firmware (>= 1.06.14) • bachmann me203 firmware (>= 1.06.14) • bachmann cs200 firmware (>= 1.06.14) • bachmann mp213 firmware (>= 1.06.14) • bachmann mp226 firmware (>= 1.06.14) • bachmann mpc240 firmware (>= 1.06.14) • bachmann mpc265 firmware (>= 1.06.14) • bachmann mpc270 firmware (>= 1.06.14) • bachmann mpc293 firmware (>= 1.06.14) • bachmann mpe270 firmware (>= 1.06.14) • bachmann cpc210 firmware (>= 1.06.14)

Related

Weakness · CWE (1)

  • CWE-916 Use of Password Hash With Insufficient Computational Effort weakness

References