title: The Auto-Maskin DCU 210E, RP-210E, and Marine Pro Observer Android App use an embedded webserver that uses unencrypted plaintext for the transmission of the administrator PIN
description: The Auto-Maskin DCU 210E, RP-210E, and Marine Pro Observer Android App use an embedded webserver that uses unencrypted plaintext for the transmission of the administrator PIN Impact: An attacker once authenticated can change configurations, upload new configuration files, and upload executable code via file upload for firmware updates. Requires access to the network. Affected releases are Auto-Maskin DCU-210E, RP-210E, and the Marine Pro Observer Android App. Versions prior to 3.7 on ARMv7.
problem types: CWE-319: Cleartext Transmission of Sensitive Information
affected:
{
platforms: ARMv7
product: DCU-210E
vendor: Auto-Maskin
versions:
lessThan: 3.7, status: affected, version: 3.7, versionType: custom
}
{
platforms: ARMv7
product: RP-210E
vendor: Auto-Maskin
versions:
lessThan: 3.7, status: affected, version: 3.7, versionType: custom
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
version: 3.0
]
solutions: The devices should implement TLS for authentication to administrator functions via embedded webserver.