Gorazd Jank

The device uses RS-485 communication between the server and the microcontroller without cryptographic protection. An attacker with access to the communication path can sniff RS-485 messages and replay previously observed messages. This allows for the spoofing of messages, such as a "quit alarm" message, to continuously deactivate the safe alarm.

The software uses weak custom cryptographic algorithms and hard-coded cryptographic keys to protect communication. An attacker in an adversary-in-the-middle position can decrypt data traffic. It is possible to break the encryption/decryption routine to decrypt messages without the encryption key or intercept sufficient messages to discover the key itself.

An incorrect authorization issue exists in the WebSocket communication used by the SafeController WebMessageBroker. An authenticated attacker with low-privileged branch user credentials can manipulate WebSocket messages by specifying controller identifiers belonging to other branches. This allows the attacker to access restricted functions and resources in other branches, such as activating boxes outside of their authorized branch.

The issue allows a denial of service (service outage) via the "/wlmdeu%2f%2e%2e%2f%2e%2e" endpoint followed by a directory reference such as "%2fetc%00index.htm" to try to read the /etc directory.

The issue allows identification of valid user accounts via username enumeration. This occurs because the system returns a "nicht einloggen" error rather than a "falsch" error when an attempt is made to access an account.

The issue allows directory traversal to read arbitrary files on the filesystem, even files that require root privileges, via the `/wlmdeu%2f%2e%2e%2f%2e%2e` endpoint. This is due to an incomplete fix for a previous issue.

A vulnerability has been identified in the web interface of affected devices due to missing server-side input sanitation, making it vulnerable to command injection. This could allow an authenticated privileged remote attacker to execute arbitrary code with root privileges.

A vulnerability has been identified that involves an exposed UART console login interface. This issue could allow an attacker with direct physical access to attempt bruteforcing or cracking the root password to gain login access to the device. The vulnerability is related to the web server software of the Siemens SICAM processor control modules, specifically affecting the CP-8031 and CP-8050 models. Exploitation of this vulnerability may enable an attacker to elevate their privileges to the root level.

A vulnerability has been identified that involves the use of hard-coded credentials in the firmware of the affected devices. This could allow an attacker with direct physical access to exploit the vulnerability for UART console login to the device, potentially leading to privilege escalation.

The issue is related to insufficient argument checking in the web server of the Siemens SICAM CP-8031 and CP-8050 processor control modules. This can be exploited by a remote attacker to execute arbitrary commands via the web server port 443/tcp if the `Remote Operation` parameter is enabled. By default, the `Remote Operation` parameter is disabled. The vulnerability could allow an unauthenticated remote attacker to perform arbitrary code execution on the device.