CVE-2021-34572 Insufficient Verification of Data Authenticity in Enbra EWM (replay attack)
Attackers can replay wireless M-Bus sensor data because the system fails to detect replays, leading to inaccurate readings.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-34572?
CVE-2021-34572 is a medium-severity vulnerability in Enbra EWM 1.7.29, published on 16 Sep 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Enbra EWM 1.7.29 does not check for or detect replay attacks sent by wireless M-Bus Security mode 5 devices. Instead timestamps of the sensor are replaced by the time of the readout even if the data is a replay of earlier data.
Weakness: CWE-345
Which versions are affected by CVE-2021-34572?
It affects 1 product.
Products include Enbra Ewm.
How do I fix CVE-2021-34572?
No fix has been published for CVE-2021-34572 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-34572 being exploited?
There is no known exploitation of CVE-2021-34572 in the wild and no public exploit code.
Other vulnerabilities in Enbra EWM 1.7.29
Sources
Also known as GHSA-7x8j-m6q2-x954.