title: Interlogix Hills ComNav  Improper Restriction of Excessive Authentication Attempts
description: There is no limit to the number of attempts to authenticate for the local configuration pages for the Hills ComNav Version 3002-19 interface, which allows local attackers to brute-force credentials.
problem types: CWE-307: Improper Restriction of Excessive Authentication Attempts
affected:
{
product: Hills ComNav
vendor: Interlogix
versions:
lessThan: 3002-19, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
]
solutions: Carrier recommends users upgrade to Version 4000-12 or later, which is the latest supported version at the time of this publication.  Please contact the Hills distributor to acquire the firmware update.
More information on this issue can be found in Carrier product security advisory number CARR-PSA-002-1121.