CVE-2019-10851

Vulnerability

Computrols CBAS version 18.0.0 uses hard-coded encryption keys [1][2]. The keys are embedded in the software, which allows anyone with access to the binary or source to discover them. This affects the building automation system's communication security.

Exploitation

An attacker who gains access to the software binary can extract the hard-coded encryption keys [1][2]. No authentication or user interaction is required to discover the keys from the software. The attacker can then use the keys to decrypt captured network traffic or communicate with the system.

Impact

Successful exploitation allows an attacker to decrypt sensitive data transmitted between CBAS components, potentially compromising confidentiality of building control commands and sensor data. This could lead to unauthorized access or manipulation of the building automation system.

Mitigation

As of the available references, no patch or workaround has been publicly disclosed for CVE-2019-10851 [1][2]. Users should monitor vendor advisories and consider network segmentation or encryption at the transport layer as interim measures.