CVE-2021-34572 - OpenCVE

Enbra EWM 1.7.29 does not check for or detect replay attacks sent by wireless M-Bus Security mode 5 devices. Instead timestamps of the sensor are replaced by the time of the readout even if the data is a replay of earlier data.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Adjacent Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

AV:A/AC:L/Au:N/C:N/I:P/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Enbra	Ewm

Configuration 1 [-]

cpe:2.3:a:enbra:ewm:1.7.29:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.fit.vutbr.cz/~polcak/CVE-2021-34572.en

History

No history.

MITRE

Status: PUBLISHED

Assigner: CERTVDE

Published: 2021-09-16T12:20:16.725908Z

Updated: 2024-09-16T17:23:17.590Z

Reserved: 2021-06-10T00:00:00

Link: CVE-2021-34572

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2021-09-16T13:15:14.310

Modified: 2021-09-28T17:16:55.577

Link: CVE-2021-34572

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "EWM 1.7.29", "vendor": "Enbra", "versions": [{"status": "affected", "version": "03.11.2019"}]}], "credits": [{"lang": "en", "value": "Libor POL\u010c\u00c1K reported to CERT@VDE"}], "datePublic": "2021-08-31T00:00:00", "descriptions": [{"lang": "en", "value": "Enbra EWM 1.7.29 does not check for or detect replay attacks sent by wireless M-Bus Security mode 5 devices. Instead timestamps of the sensor are replaced by the time of the readout even if the data is a replay of earlier data."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-345", "description": "CWE-345 Insufficient Verification of Data Authenticity", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-09-16T12:20:16", "orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.fit.vutbr.cz/~polcak/CVE-2021-34572.en"}], "source": {"discovery": "UNKNOWN"}, "title": "Insufficient Verification of Data Authenticity in Enbra EWM (replay attack)", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "info@cert.vde.com", "DATE_PUBLIC": "2021-08-31T22:00:00.000Z", "ID": "CVE-2021-34572", "STATE": "PUBLIC", "TITLE": "Insufficient Verification of Data Authenticity in Enbra EWM (replay attack)"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "EWM 1.7.29", "version": {"version_data": [{"version_affected": "=", "version_value": "03.11.2019"}]}}]}, "vendor_name": "Enbra"}]}}, "credit": [{"lang": "eng", "value": "Libor POL\u010c\u00c1K reported to CERT@VDE"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Enbra EWM 1.7.29 does not check for or detect replay attacks sent by wireless M-Bus Security mode 5 devices. Instead timestamps of the sensor are replaced by the time of the readout even if the data is a replay of earlier data."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-345 Insufficient Verification of Data Authenticity"}]}]}, "references": {"reference_data": [{"name": "https://www.fit.vutbr.cz/~polcak/CVE-2021-34572.en", "refsource": "CONFIRM", "url": "https://www.fit.vutbr.cz/~polcak/CVE-2021-34572.en"}]}, "source": {"discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T00:19:47.009Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.fit.vutbr.cz/~polcak/CVE-2021-34572.en"}]}]}, "cveMetadata": {"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "assignerShortName": "CERTVDE", "cveId": "CVE-2021-34572", "datePublished": "2021-09-16T12:20:16.725908Z", "dateReserved": "2021-06-10T00:00:00", "dateUpdated": "2024-09-16T17:23:17.590Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:enbra:ewm:1.7.29:*:*:*:*:*:*:*", "matchCriteriaId": "C983990C-D1DE-42C2-B6A2-8D9BD0B5A4FF", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Enbra EWM 1.7.29 does not check for or detect replay attacks sent by wireless M-Bus Security mode 5 devices. Instead timestamps of the sensor are replaced by the time of the readout even if the data is a replay of earlier data."}, {"lang": "es", "value": "Enbra EWM versi\u00f3n 1.7.29, no comprueba ni detecta los ataques de repetici\u00f3n enviados por los dispositivos inal\u00e1mbricos M-Bus Security mode 5. En su lugar, las marcas de tiempo del sensor se sustituyen por la hora de la lectura, incluso si los datos son una repetici\u00f3n de datos anteriores"}], "id": "CVE-2021-34572", "lastModified": "2021-09-28T17:16:55.577", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 3.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:A/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.5, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "info@cert.vde.com", "type": "Secondary"}]}, "published": "2021-09-16T13:15:14.310", "references": [{"source": "info@cert.vde.com", "tags": ["Third Party Advisory"], "url": "https://www.fit.vutbr.cz/~polcak/CVE-2021-34572.en"}], "sourceIdentifier": "info@cert.vde.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-345"}], "source": "info@cert.vde.com", "type": "Primary"}]}