Monolith EASY HOME Alarmanlagen-Set Radio authentication replay

Summaryinfo

A vulnerability was found in Monolith EASY HOME Alarmanlagen-Set. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Radio. Such manipulation leads to authentication replay. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Monolith EASY HOME Alarmanlagen-Set (version now known). Affected by this issue is some unknown processing of the component Radio. The manipulation with an unknown input leads to a authentication replay vulnerability. Using CWE to declare the problem leads to CWE-294. A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes). Impacted is confidentiality, integrity, and availability.

The weakness was shared 11/23/2016 by Matthias Deeg as [SYSS-2016-106] EASY HOME Alarmanlagen-Set - Missing Protection against Replay Attacks as confirmed mailinglist post (Bugtraq). The advisory is shared for download at seclists.org. The vendor cooperated in the coordination of the public release. The attack needs to be approached locally. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1040. The advisory points out:

SySS GmbH found out that the radio communication protocol used by the EASY HOME MAS-S01-09 wireless alarm system and its remote control is not protected against replay attacks. Therefore, an attacker can record the 433 MHz radio signal of a wireless remote control, for example using a software-defined radio, when the alarm system is disarmed by its owner, and play it back at a later time in order to disable the alarm system at will.

The vulnerability was handled as a non-public zero-day exploit for at least 58 days. During that time the estimated underground price was around $0-$5k.

Upgrading eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Monolith

Name

• EASY HOME Alarmanlagen-Set

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion