CVE-2020-7233 : Security Advisory and Response

KMS Controls BAC-A1616BC BACnet devices have a cleartext password of snowman in the BACKDOOR_NAME variable in the BC_Logon.swf file.

Understanding CVE-2020-7233

This CVE identifies a vulnerability in KMS Controls BAC-A1616BC BACnet devices due to a cleartext password exposure.

What is CVE-2020-7233?

The vulnerability involves the presence of a cleartext password 'snowman' in the BACKDOOR_NAME variable within the BC_Logon.swf file of the affected devices.

The Impact of CVE-2020-7233

The presence of a cleartext password in a critical file can lead to unauthorized access and compromise of the affected BACnet devices.

Technical Details of CVE-2020-7233

The technical aspects of the CVE include:

Vulnerability Description

Cleartext password 'snowman' in the BACKDOOR_NAME variable

Affected Systems and Versions

Product: n/a
Vendor: n/a
Version: n/a

Exploitation Mechanism

Attackers can exploit the vulnerability by leveraging the exposed cleartext password to gain unauthorized access to the BACnet devices.

Mitigation and Prevention

Steps to address the CVE include:

Immediate Steps to Take

Change the default password to a strong, unique one
Monitor and restrict access to the affected devices

Long-Term Security Practices

Implement regular password changes and updates
Conduct security audits and assessments periodically

Patching and Updates

Apply patches or updates provided by KMS Controls to remove the cleartext password vulnerability.