Local Access to Sensitive Data in Brivo ACS100 and ACS300

Vulnerability

An insufficiently protected credentials vulnerability exists in Brivo ACS100 and ACS300 access control systems. Affected versions are from 5.2.4 up to but not including 6.2.4.3; versions prior to 5.2.4 may also be affected [1]. The issue lies in how the systems store or transmit credentials, allowing an attacker to recover passwords [1].

Exploitation

An attacker with local access to the device or network can exploit improper access controls to recover stored credentials [1]. The exact mechanism is not detailed, but the vulnerability is classified as password recovery exploitation, indicating the attacker can extract or guess passwords without proper authentication.

Impact

Successful exploitation allows the attacker to recover credentials, enabling them to bypass physical security measures controlled by the Brivo system [1]. This could lead to unauthorized access to secured facilities.

Mitigation

Brivo has released version 6.2.4.3 to address the vulnerability [1]. Users should upgrade to this version or later. No workarounds are documented in the available reference.