Vulnerability · Published Jun 17, 2020 · Assigned by mitre
CVE-2020-14157
High 8.1
In plain English
A high-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).
Severity (CVSS NVD)8.1High
Exploit odds (30 days)0.8%top 43.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The wireless-communication feature of the ABUS Secvest FUBE50001 device does not encrypt sensitive data such as PIN codes or IDs of used proximity chip keys (RFID tokens). This makes it easier for an attacker to disarm the wireless alarm system.
Affected products (as reported)
References
- https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-014.txt x_refsource_MISC
- https://www.youtube.com/watch?v=kCqAVYyahLc x_refsource_MISC
- 20200623 [SYSS_2020-014]: ABUS Secvest Wireless Control Device (FUBE50001) - Missing Encryption of Sensitive Data (CWE-311) (CVE-2020-14157) mailing-list, x_refsource_FULLDISC
- http://packetstormsecurity.com/files/158204/ABUS-Secvest-Wireless-Control-Device-Missing-Encryption.html x_refsource_MISC