Welcome to FM Industry

In Focus / Company News, Automation, Robotics & Artificial Intelligence (AI), Americas, Technology, Automation & Robotics, ICT

Security Patch for SAUTER CASE Suite Building Automation Software Vulnerability

05 November 2018 / by Applied Risk (author) / Amsterdam
 (photo: )

Applied Risk researcher, Gjoko Krstic, has identified a security vulnerability in the SAUTER CASE Suite, a software package used to handle building automation projects with energy-efficient strategies and methods. The impact of this vulnerability is that an unauthenticated user can craft a malicious XML data file that allows them to access sensitive information or configuration files, potentially impacting the availability of the affected application.

 

The SAUTER Case Suite is a building management software that is used for project engineering and control functions of building management systems within both office and industrial environments. The application suffers from an XML External Entity (XXE) vulnerability, which can be used to cause a Denial of Service (DoS) condition via a specially crafted XML file.

 

This vulnerability is classified as high risk and has therefore been given a CVSS (Common Vulnerability Scoring System) of 8.6. Applied Risk has worked alongside SAUTER in the responsible disclosure process, with the vendor releasing a patch within 10 days of disclosure by ICS-CERT on October 15th. It is recommended to organisations utilising the SAUTER CASE Suite building automation software to update to the latest version.

The updates are available via the following link: https://www.sauter-controls.com/en/products-sauter/product-details/pdm/gzs-100-150-case-suite.html

To read an overview of the SAUTER CASE Suite advisory, please visit: https://applied-risk.com/application/files/7715/4115/4554/Sauter_Case_Suite_XXE_OOB_Vulnerability.pdf 




Applied Risk

Author

Applied Risk

Applied Risk is an established leader in Industrial Control Systems security that helps to protect assets and reduce security risk. They do this by providing organisations ranging from Fortune 500 enterprises to small-to-medium sized businesses with the services and solutions they need to transform the way they procure, build, integrate and manage their critical infrastructures. Established in 2012, Applied Risk has quickly grown to become a major cybersecurity player within the Industrial Automation and Process Control Domain. To learn more, visit www.applied-risk.com.

Article rating:

vote data

Write a Comment

Copyright © 2004-2019 Integrated Identity Limited | All rights reserved