Iñaki Lázaro Ayanz

**Name of the Vulnerable Software and Affected Versions** SAUTER Controls Nova 200–220 Series versions 3.3-006 and prior BACnetstac versions 4.2.1 and prior **Description** The issue affects device management, where sensitive information such as credentials is sent in cleartext through FTP and Telnet protocols. An attacker could obtain this sensitive information to gain access to the system. **Recommendations** For SAUTER Controls Nova 200–220 Series versions 3.3-006 and prior, consider disabling the use of FTP and Telnet protocols for device management until a secure alternative is available. For BACnetstac versions 4.2.1 and prior, restrict access to the system using FTP and Telnet to minimize the risk of exploitation. As a temporary workaround, avoid using cleartext protocols for communicating sensitive information, such as credentials, until a patch or secure alternative is available.

**Name of the Vulnerable Software and Affected Versions** SAUTER Controls Nova 200–220 Series versions 3.3-006 and prior SAUTER Controls Nova 230 versions (affected versions not specified) SAUTER Controls Nova 106 versions (affected versions not specified) BACnetstac version 4.2.1 and prior **Description** The issue is related to the lack of authentication for a critical function in the programmable logic controllers' software. This allows a remote attacker to bypass security restrictions and execute arbitrary commands. The vulnerability can be exploited through Telnet and file transfer protocol (FTP), which are the only protocols available for device management, enabling an unauthorized user to access the system, modify the device configuration, and execute malicious commands. **Recommendations** For SAUTER Controls Nova 200–220 Series versions 3.3-006 and prior, consider disabling Telnet and FTP protocols until a patch is available. For SAUTER Controls Nova 230 and 106, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For BACnetstac version 4.2.1 and prior, restrict access to the system to minimize the risk of exploitation until a fix is available.