CVE-2021-40825

Vulnerability

nLight ECLYPSE (nECY) system controllers running software prior to version 1.17.21245.754 contain a default key vulnerability. The devices do not force a change to the key upon initial configuration, leaving the default key in place. This key is used to secure encrypted communications between the SensorView configuration software and nECY devices, as well as between nECY controllers themselves. The key is referred to as the SensorView Password in the nECY nLight Explorer Interface and the Gateway Password in the SensorView application [1].

Exploitation

A remote attacker with IP access to an affected nECY controller can exploit this vulnerability by leveraging the default key. No authentication or user interaction is required. The attacker can submit lighting control commands by communicating over the encrypted channel using the well-known default key. For systems connected to an IP network, network access is sufficient; standalone systems require physical access [1].

Impact

A successful attack allows the attacker to modify lighting conditions (e.g., turn lights on/off, adjust dimming) and potentially update the software on lighting devices connected to the nECY. However, the attacker cannot authenticate to or modify the configuration or software of the nECY system controller itself [1].

Mitigation

Acuity Brands released firmware version 1.17.21245.754 to address this vulnerability. Users should update affected devices to this version or later. If updating is not immediately possible, changing the default key (SensorView Password / Gateway Password) to a strong, unique value mitigates the risk [1].