Honeywell Saia Burgess PG5 PCD
The affected product uses the S-Bus protocol with authentication functions that can be controlled by the client MAC and IP. Because UDP is stateless, an attacker that can observe traffic can also spoof the MAC and IP of an authenticated client and manipulate the controller configuration.CVE-2022-30319 has been assigned to this vulnerability. A CVSS v3 base score of 7.6 has been assigned; the CVSS vector string is (AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L). The affected product uses the S-Bus write byte message to a specific address and supplies a hashed version of the password. The hashing algorithm is based on CRC-16 and, as such, is not cryptographically secure.CVE-2022-30320 has been assigned to this vulnerability. A CVSS v3 base score of 7.6 has been assigned; the CVSS vector string is (AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L).