CVE-2021-34577 The value of the Kaden PICOFLUX AiR water meter can be read through wireless M-Bus mode 5 with a hardcoded shared key.

CVE-2021-34577 The value of the Kaden PICOFLUX AiR water meter can be read through wireless M-Bus mode 5 with a hardcoded shared key.

This can be done by using a Bluetooth 4.0 low energy device or by using an active scanner. Then, when the device is connected to the network, an attacker can read the value, and see how much water has been consumed. This is possible since the PICOFLUX AiR water meter has an M-Bus interface 5. This is a wireless protocol used by a large number of devices, such as sensors, water pumps, etc. These devices can be controlled remotely and sent data to the M-Bus receiving device. An adversary can read these data, and collect them to use for other purposes. For example, an adversary can read the data of an irrigation system or a water pump and start to manipulate it to cause a water leak.

References

Subscribe to CVE.news
Don’t miss out on the latest issues. Sign up now to get access to the library of members-only issues.
jamie@example.com
Subscribe