VulnerabilityModified
CVE-2020-14157
This makes it easier for an attacker to disarm the wireless alarm system.
HIGH 8.1EPSS 0.79%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.79%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The wireless-communication feature of the ABUS Secvest FUBE50001 device does not encrypt sensitive data such as PIN codes or IDs of used proximity chip keys (RFID tokens). This makes it easier for an attacker to disarm the wireless alarm system.
- CVSS 3.1
- 8.1 HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- EPSS
- 0.79% probability · 54th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-319
- Affected
- abus/secvest wireless control fube50001 firmware
- Source
- cve@mitre.org
References
- http://packetstormsecurity.com/files/158204/ABUS-Secvest-Wireless-Control-Device-Missing-Encryption.htmlThird Party Advisory
- http://seclists.org/fulldisclosure/2020/Jun/26Third Party Advisory
- https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-014.txtExploit, Third Party Advisory
- https://www.youtube.com/watch?v=kCqAVYyahLcExploit, Third Party Advisory
- http://packetstormsecurity.com/files/158204/ABUS-Secvest-Wireless-Control-Device-Missing-Encryption.htmlThird Party Advisory
- http://seclists.org/fulldisclosure/2020/Jun/26Third Party Advisory
- https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-014.txtExploit, Third Party Advisory
- https://www.youtube.com/watch?v=kCqAVYyahLcExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.