important · Firmware — Building controls
An unauthenticated firmware-update race can install unauthorized code on SAUTER building controllers.
Affects
SAUTER modulo 6 and EY-modulo 5 building-automation controllers used to operate building systems.
The race replaces an update after validation but before use.
Detail and 1 source
We do not know its practical LAN or WAN exposure or the privilege of the installed code.
Chain to watch
Reach the firmware-update service→↓Replace the artifact between validation and use→↓Install or execute unauthorized controller code→↓The listening interface and execution identity are undocumented.
Unverified chainCapture a stock controller's listeners and run a benign replacement image that reports its identity.