VAR-202006-0224
Vulnerability from variot - Updated: 2023-12-18 13:01The wireless-communication feature of the ABUS Secvest FUBE50001 device does not encrypt sensitive data such as PIN codes or IDs of used proximity chip keys (RFID tokens). This makes it easier for an attacker to disarm the wireless alarm system. ABUS Secvest FUBE50001 The device contains a vulnerability related to information leakage.Information may be obtained and tampered with. ABUS Secvest FUBE50001 is a wireless control unit of German ABUS company.
There is a security loophole in the wireless communication function of the ABUS Secvest FUBE50001 device, which is caused by the program not encrypting sensitive data. Advisory ID: SYSS-2020-014 Product: ABUS Secvest Wireless Control Device (FUBE50001) Manufacturer: ABUS Affected Version(s): N/A Tested Version(s): N/A Vulnerability Type: Missing Encryption of Sensitive Data (CWE-311) Risk Level: High Solution Status: Open Manufacturer Notification: 2020-04-03 Solution Date: - Public Disclosure: 2020-06-17 CVE Reference: CVE-2020-14157 Authors of Advisory: Michael Rüttgers, Thomas Detert, Matthias Deeg (SySS GmbH)
Overview:
ABUS Secvest Wireless Control Device (FUBE50001) is a wireless control
panel for the ABUS Secvest wireless alarm system.
Some of the device features as described by the manufacturer are
(see [1]):
"
* Easy operation via code or proximity keyfob
The Secvest wireless control panel is an optional Secvest accessory.
Every wireless control panel can be operated from your system via PIN
code. It is possible to arm and disarm the panel via proximity keyfob.
* Flexible use in entrance areas
Up to 8 control panels can be integrated into the alarm system. These
additional modules can be placed in various areas of the building.
This provides added convenience for you, because Secvest can be armed
and disarmed directly on the wireless control panel, without the need
to go back to the central alarm panel every time.
In addition to internal arming or arming individual sub-areas, you can
also switch a single output, such as the garage door, if desired.
* Secure wireless communication
Thanks to a secure wireless communication procedure, this product is
protected against ‘replay attacks’, as are the Secvest wireless alarm
system and Secvest Touch alarm systems. This procedure for preventing
third-party tampering exceeds the requirements of the “DIN EN 50131-1
level 2” security standard.
Thus, an attacker observing radio signals of an ABUS FUBE50001
wireless control panel is able to see all sensitive data of transmitted
packets as cleartext and can analyze the used packet format and the
communication protocol.
By knowing the correct PIN code or the ID of a valid ABUS Secvest
proximity chip key, an attacker is able to disarm the wireless alarm
system in an unauthorized way.
Proof of Concept (PoC):
Michael Rüttgers, Thomas Detert, and Matthias Deeg developed different PoC software tools, either for the RFCat-based radio dongle YARD Stick One [3] in one version, or the GreatFet One neighbor Erica [4] in another one, that allowed sniffing out used PIN codes or used proximity chip key IDs when eavesdropping on the FUBE50001 wireless communication.
The following output exemplarily shows a successful PIN code sniffing attack:
$ python2 abus_fube50001_pin_sniffer.py ABUS Secvest FUBE50001 PIN Code Sniffer PoC - SySS GmbH (c) 2020 by Thomas Detert, Michael Rüttgers, and Matthias Deeg
[] Listening for ABUS FUBE50001 packets ... [] Received packet: f0f352b4ccb4ccd52aab52d2acd2d34d4cb34cb333332b34d4b530f0f0f352b4ccb4ccd52aab52d2acd2d34d4cb34cb333332b34d4b530f0f0f333333333117162f5 [] Decoded packet : da0a077ed5c549888800626b [] Received packet: f0f352b4b32b4d352ad5332aab2cb34cd3332cccb4ccacb354acaaaaccccd2ab32aab54d30f0f0f352b4b32b4d352ad5332aab2cb34cd3332cccb4ccacb354acaaaa [] Decoded packet : da86937707e4884040a0c8ecff005e1fb9 [] Detected FUBE50001 packet with FUBE50001 PIN [+] Sniffed PIN code: 1337 (...)
An example of a successful sniffing attack regarding the ID of an ABUS proximity chip key is illustrated in the following output:
$ python2 abus_fube50001_chip_key_id_sniffer.py ABUS Secvest FUBE50001 Proximity Chip Key ID Sniffer PoC - SySS GmbH (c) 2020 by Thomas Detert, Michael Rüttgers, and Matthias Deeg
[] Listening for ABUS FUBE50001 packets ... [] Received packet: f0f352b4b332b2cad52accd554d34cb32cccd33332b34ab2cd2b2d4ad32ad2aacaacd32b30f0f0f3057c0764bf788b6ce7d0de43f6c1cb71e7374b7bd7c7a1abe567 [] Decoded packet: da81937707e488404018b9165b475f3c46 [] Detected FUBE50001 packet with proximity token ID [+] Sniffed proximity chip key ID: 3805964445 (...)
The described sniffing attacks are also demonstrated in the SySS Proof-of-Concept Video titled "ABUS Secvest Sniffing Attack" which is available on the SySS YouTube Channel [8].
Solution:
SySS GmbH is not aware of a solution for this reported security
vulnerability.
Disclosure Timeline:
2020-04-03: Vulnerability reported to manufacturer 2020-06-17: Public release of security advisory
References:
[1] Product website for ABUS Secvest wireless control device
https://www.abus.com/eng/Home-Security/Alarm-systems/Secvest-wireless-alarm-system/Control-devices-and-extensions/Secvest-Wireless-Control-Device
[2] SySS Security Advisory SYSS-2018-035
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2018-035.txt
[3] Product website YARD Stick One
https://greatscottgadgets.com/yardstickone/
[4] GreatFET One neighbor Erica targeting the 315/433/868/915 MHz
freqency bands
https://github.com/AsFaBw/erica
[5] GreatFET wiki
https://github.com/greatscottgadgets/greatfet/wiki
[6] SySS Security Advisory SYSS-2020-014
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-014.txt
[7] SySS GmbH, SySS Responsible Disclosure Policy
https://www.syss.de/en/news/responsible-disclosure-policy/
[8] SySS Proof of Concept Video: ABUS Secvest Sniffing Attack
https://www.youtube.com/watch?v=kCqAVYyahLc
Credits:
This security vulnerability was found by Michael Rüttgers and Thomas Detert.
Mr. Rüttgers and Mr. Detert reported this finding to SySS GmbH where it was verified and later reported to the manufacturer by Matthias Deeg.
E-Mail: matthias.deeg (at) syss.de Public Key: https://www.syss.de/fileadmin/dokumente/Materialien/PGPKeys/Matthias_Deeg.asc Key fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB
Disclaimer:
The information provided in this security advisory is provided "as is"
and without warranty of any kind. Details of this security advisory may
be updated in order to provide as accurate information as possible. The
latest version of this security advisory is available on the SySS website.
Copyright:
Creative Commons - Attribution (by) - Version 3.0 URL: http://creativecommons.org/licenses/by/3.0/deed.en
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202006-0224",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "secvest wireless control fube50001",
"scope": "eq",
"trust": 1.0,
"vendor": "abus",
"version": null
},
{
"model": "secvest wireless remote control fube50001",
"scope": null,
"trust": 0.8,
"vendor": "abus",
"version": null
},
{
"model": "secvest fube50001",
"scope": null,
"trust": 0.6,
"vendor": "abus",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2021-20276"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-006935"
},
{
"db": "NVD",
"id": "CVE-2020-14157"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:abus:secvest_wireless_control_fube50001_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:abus:secvest_wireless_control_fube50001:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2020-14157"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Thomas Detert, Michael Ruttgers",
"sources": [
{
"db": "PACKETSTORM",
"id": "158204"
},
{
"db": "CNNVD",
"id": "CNNVD-202006-1196"
}
],
"trust": 0.7
},
"cve": "CVE-2020-14157",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 6.5,
"impactScore": 4.9,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:A/AC:L/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Adjacent Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 4.8,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "JVNDB-2020-006935",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:A/AC:L/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 6.5,
"id": "CNVD-2021-20276",
"impactScore": 4.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:A/AC:L/Au:N/C:P/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"impactScore": 5.2,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Adjacent Network",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 8.1,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "JVNDB-2020-006935",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2020-14157",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "JVNDB-2020-006935",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2021-20276",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-202006-1196",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2021-20276"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-006935"
},
{
"db": "NVD",
"id": "CVE-2020-14157"
},
{
"db": "CNNVD",
"id": "CNNVD-202006-1196"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The wireless-communication feature of the ABUS Secvest FUBE50001 device does not encrypt sensitive data such as PIN codes or IDs of used proximity chip keys (RFID tokens). This makes it easier for an attacker to disarm the wireless alarm system. ABUS Secvest FUBE50001 The device contains a vulnerability related to information leakage.Information may be obtained and tampered with. ABUS Secvest FUBE50001 is a wireless control unit of German ABUS company. \n\r\n\r\nThere is a security loophole in the wireless communication function of the ABUS Secvest FUBE50001 device, which is caused by the program not encrypting sensitive data. Advisory ID: SYSS-2020-014\nProduct: ABUS Secvest Wireless Control Device (FUBE50001)\nManufacturer: ABUS\nAffected Version(s): N/A\nTested Version(s): N/A\nVulnerability Type: Missing Encryption of Sensitive Data (CWE-311)\nRisk Level: High\nSolution Status: Open\nManufacturer Notification: 2020-04-03\nSolution Date: -\nPublic Disclosure: 2020-06-17\nCVE Reference: CVE-2020-14157\nAuthors of Advisory: Michael R\u00fcttgers, Thomas Detert,\n Matthias Deeg (SySS GmbH)\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nOverview:\n\nABUS Secvest Wireless Control Device (FUBE50001) is a wireless control\npanel for the ABUS Secvest wireless alarm system. \n\nSome of the device features as described by the manufacturer are\n(see [1]):\n\n\"\n* Easy operation via code or proximity keyfob\n The Secvest wireless control panel is an optional Secvest accessory. \n Every wireless control panel can be operated from your system via PIN\n code. It is possible to arm and disarm the panel via proximity keyfob. \n\n* Flexible use in entrance areas\n Up to 8 control panels can be integrated into the alarm system. These\n additional modules can be placed in various areas of the building. \n This provides added convenience for you, because Secvest can be armed\n and disarmed directly on the wireless control panel, without the need\n to go back to the central alarm panel every time. \n In addition to internal arming or arming individual sub-areas, you can\n also switch a single output, such as the garage door, if desired. \n\n* Secure wireless communication\n Thanks to a secure wireless communication procedure, this product is\n protected against \u2018replay attacks\u2019, as are the Secvest wireless alarm\n system and Secvest Touch alarm systems. This procedure for preventing\n third-party tampering exceeds the requirements of the \u201cDIN EN 50131-1\n level 2\u201d security standard. \n\nThus, an attacker observing radio signals of an ABUS FUBE50001\nwireless control panel is able to see all sensitive data of transmitted\npackets as cleartext and can analyze the used packet format and the\ncommunication protocol. \n\nBy knowing the correct PIN code or the ID of a valid ABUS Secvest\nproximity chip key, an attacker is able to disarm the wireless alarm\nsystem in an unauthorized way. \n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nProof of Concept (PoC):\n\nMichael R\u00fcttgers, Thomas Detert, and Matthias Deeg developed different\nPoC software tools, either for the RFCat-based radio dongle YARD Stick\nOne [3] in one version, or the GreatFet One neighbor Erica [4] in another\none, that allowed sniffing out used PIN codes or used proximity chip key\nIDs when eavesdropping on the FUBE50001 wireless communication. \n\nThe following output exemplarily shows a successful PIN code sniffing\nattack:\n\n$ python2 abus_fube50001_pin_sniffer.py\nABUS Secvest FUBE50001 PIN Code Sniffer PoC - SySS GmbH (c) 2020\nby Thomas Detert, Michael R\u00fcttgers, and Matthias Deeg\n---\n[*] Listening for ABUS FUBE50001 packets ... \n[*] Received packet:\nf0f352b4ccb4ccd52aab52d2acd2d34d4cb34cb333332b34d4b530f0f0f352b4ccb4ccd52aab52d2acd2d34d4cb34cb333332b34d4b530f0f0f333333333117162f5\n[*] Decoded packet : da0a077ed5c549888800626b\n[*] Received packet:\nf0f352b4b32b4d352ad5332aab2cb34cd3332cccb4ccacb354acaaaaccccd2ab32aab54d30f0f0f352b4b32b4d352ad5332aab2cb34cd3332cccb4ccacb354acaaaa\n[*] Decoded packet : da86937707e4884040a0c8ecff005e1fb9\n[*] Detected FUBE50001 packet with FUBE50001 PIN\n[+] Sniffed PIN code: 1337\n(...)\n\nAn example of a successful sniffing attack regarding the ID of an ABUS\nproximity chip key is illustrated in the following output:\n\n$ python2 abus_fube50001_chip_key_id_sniffer.py\nABUS Secvest FUBE50001 Proximity Chip Key ID Sniffer PoC - SySS GmbH (c)\n2020\nby Thomas Detert, Michael R\u00fcttgers, and Matthias Deeg\n---\n[*] Listening for ABUS FUBE50001 packets ... \n[*] Received packet:\nf0f352b4b332b2cad52accd554d34cb32cccd33332b34ab2cd2b2d4ad32ad2aacaacd32b30f0f0f3057c0764bf788b6ce7d0de43f6c1cb71e7374b7bd7c7a1abe567\n[*] Decoded packet: da81937707e488404018b9165b475f3c46\n[*] Detected FUBE50001 packet with proximity token ID\n[+] Sniffed proximity chip key ID: 3805964445\n(...)\n\n\nThe described sniffing attacks are also demonstrated in the SySS\nProof-of-Concept Video titled \"ABUS Secvest Sniffing Attack\" which is\navailable on the SySS YouTube Channel [8]. \n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSolution:\n\nSySS GmbH is not aware of a solution for this reported security\nvulnerability. \n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclosure Timeline:\n\n2020-04-03: Vulnerability reported to manufacturer\n2020-06-17: Public release of security advisory\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nReferences:\n\n[1] Product website for ABUS Secvest wireless control device\n\nhttps://www.abus.com/eng/Home-Security/Alarm-systems/Secvest-wireless-alarm-system/Control-devices-and-extensions/Secvest-Wireless-Control-Device\n[2] SySS Security Advisory SYSS-2018-035\n\nhttps://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2018-035.txt\n[3] Product website YARD Stick One\n https://greatscottgadgets.com/yardstickone/\n[4] GreatFET One neighbor Erica targeting the 315/433/868/915 MHz\nfreqency bands\n https://github.com/AsFaBw/erica\n[5] GreatFET wiki\n https://github.com/greatscottgadgets/greatfet/wiki\n[6] SySS Security Advisory SYSS-2020-014\n\nhttps://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-014.txt\n[7] SySS GmbH, SySS Responsible Disclosure Policy\n https://www.syss.de/en/news/responsible-disclosure-policy/\n[8] SySS Proof of Concept Video: ABUS Secvest Sniffing Attack\n https://www.youtube.com/watch?v=kCqAVYyahLc\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCredits:\n\nThis security vulnerability was found by Michael R\u00fcttgers and Thomas\nDetert. \n\nMr. R\u00fcttgers and Mr. Detert reported this finding to SySS GmbH where it\nwas verified and later reported to the manufacturer by Matthias Deeg. \n\nE-Mail: matthias.deeg (at) syss.de\nPublic Key:\nhttps://www.syss.de/fileadmin/dokumente/Materialien/PGPKeys/Matthias_Deeg.asc\nKey fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclaimer:\n\nThe information provided in this security advisory is provided \"as is\"\nand without warranty of any kind. Details of this security advisory may\nbe updated in order to provide as accurate information as possible. The\nlatest version of this security advisory is available on the SySS website. \n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCopyright:\n\nCreative Commons - Attribution (by) - Version 3.0\nURL: http://creativecommons.org/licenses/by/3.0/deed.en\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2020-14157"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-006935"
},
{
"db": "CNVD",
"id": "CNVD-2021-20276"
},
{
"db": "PACKETSTORM",
"id": "158204"
}
],
"trust": 2.25
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2020-14157",
"trust": 3.1
},
{
"db": "PACKETSTORM",
"id": "158204",
"trust": 1.7
},
{
"db": "JVNDB",
"id": "JVNDB-2020-006935",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2021-20276",
"trust": 0.6
},
{
"db": "NSFOCUS",
"id": "47348",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202006-1196",
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2021-20276"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-006935"
},
{
"db": "PACKETSTORM",
"id": "158204"
},
{
"db": "NVD",
"id": "CVE-2020-14157"
},
{
"db": "CNNVD",
"id": "CNNVD-202006-1196"
}
]
},
"id": "VAR-202006-0224",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2021-20276"
}
],
"trust": 1.6
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2021-20276"
}
]
},
"last_update_date": "2023-12-18T13:01:44.492000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "https://www.abus.com/eng"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-006935"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-319",
"trust": 1.0
},
{
"problemtype": "CWE-200",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-006935"
},
{
"db": "NVD",
"id": "CVE-2020-14157"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.1,
"url": "https://www.syss.de/fileadmin/dokumente/publikationen/advisories/syss-2020-014.txt"
},
{
"trust": 2.2,
"url": "http://packetstormsecurity.com/files/158204/abus-secvest-wireless-control-device-missing-encryption.html"
},
{
"trust": 1.7,
"url": "https://www.youtube.com/watch?v=kcqavyyahlc"
},
{
"trust": 1.6,
"url": "http://seclists.org/fulldisclosure/2020/jun/26"
},
{
"trust": 1.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-14157"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-14157"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/47348"
},
{
"trust": 0.1,
"url": "http://creativecommons.org/licenses/by/3.0/deed.en"
},
{
"trust": 0.1,
"url": "https://www.syss.de/en/news/responsible-disclosure-policy/"
},
{
"trust": 0.1,
"url": "https://www.syss.de/fileadmin/dokumente/publikationen/advisories/syss-2018-035.txt"
},
{
"trust": 0.1,
"url": "https://www.abus.com/eng/home-security/alarm-systems/secvest-wireless-alarm-system/control-devices-and-extensions/secvest-wireless-control-device"
},
{
"trust": 0.1,
"url": "https://www.syss.de/fileadmin/dokumente/materialien/pgpkeys/matthias_deeg.asc"
},
{
"trust": 0.1,
"url": "https://github.com/asfabw/erica"
},
{
"trust": 0.1,
"url": "https://github.com/greatscottgadgets/greatfet/wiki"
},
{
"trust": 0.1,
"url": "https://greatscottgadgets.com/yardstickone/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2021-20276"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-006935"
},
{
"db": "PACKETSTORM",
"id": "158204"
},
{
"db": "NVD",
"id": "CVE-2020-14157"
},
{
"db": "CNNVD",
"id": "CNNVD-202006-1196"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2021-20276"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-006935"
},
{
"db": "PACKETSTORM",
"id": "158204"
},
{
"db": "NVD",
"id": "CVE-2020-14157"
},
{
"db": "CNNVD",
"id": "CNNVD-202006-1196"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2021-03-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2021-20276"
},
{
"date": "2020-07-22T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2020-006935"
},
{
"date": "2020-06-23T21:28:06",
"db": "PACKETSTORM",
"id": "158204"
},
{
"date": "2020-06-17T20:15:10.057000",
"db": "NVD",
"id": "CVE-2020-14157"
},
{
"date": "2020-06-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202006-1196"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2021-03-23T00:00:00",
"db": "CNVD",
"id": "CNVD-2021-20276"
},
{
"date": "2020-07-22T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2020-006935"
},
{
"date": "2021-07-21T11:39:23.747000",
"db": "NVD",
"id": "CVE-2020-14157"
},
{
"date": "2020-07-31T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202006-1196"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote or local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202006-1196"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "ABUS Secvest FUBE50001 Information Disclosure Vulnerability",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2021-20276"
},
{
"db": "CNNVD",
"id": "CNNVD-202006-1196"
}
],
"trust": 1.2
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "information disclosure",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202006-1196"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…