Full Report
Researchers discovered 49,000 misconfigured and exposed Access Management Systems (AMS) across multiple industries and countries, which could compromise privacy and physical security in critical sectors. [...]
Analysis Summary
# Vulnerability: Misconfigured Building Access Systems (AMS) Exposed Online
## CVE Details
- **CVE ID:** Not explicitly provided in the article. This appears to be a widespread configuration issue rather than a single, specific software vulnerability tracked by a CVE.
- **CVSS Score:** Not applicable/Not provided, as this relates to misconfiguration exposing data rather than a specific software flaw.
- **CWE:** CWE-200 (Exposure of Sensitive Information to an Inappropriate Actor) is relevant due to the public exposure of sensitive data.
## Affected Systems
- **Products:** Building Access Systems (AMS), specifically those utilizing Modat or similar software/hardware, which are directly accessible via the internet.
- **Versions:** Unknown/All versions of AMS that are deployed without proper network access controls.
- **Configurations:** Systems configured to be publicly accessible over the internet without authentication or network segmentation (e.g., not placed behind a firewall or VPN).
## Vulnerability Description
A large number of Building Access Systems (AMS) globally (over 49,000 identified) have been inadvertently exposed to the public internet due to misconfigurations. This exposure allows remote, unauthenticated access to sensitive physical security data and control interfaces.
The exposed data includes:
* Personally Identifiable Information (PII) such as names, email addresses, phone numbers.
* Biometric data (fingerprints, facial recognition).
* Access logs, photographs, and work schedules.
In some cases, attackers can exploit these exposed administrative functions to modify employee records, add fake entries, change access credentials, or grant/deny physical access to buildings.
## Exploitation
- **Status:** The issue involves active exposure; whether direct exploitation for data exfiltration or system control is widespread is suggested but not confirmed as current "in the wild" campaigns. **PoC available** in the form of successful scanning/identification by researchers.
- **Complexity:** Low, as the primary vector is accessible configuration errors found via direct internet scanning.
- **Attack Vector:** Network (Remote, unauthenticated access).
## Impact
- **Confidentiality:** High (Exposure of PII, biometric data, and internal access logs).
- **Integrity:** High (Ability to manipulate employee records and access control credentials/logs).
- **Availability:** Medium (Potential for denial of service or restricted physical access for legitimate users).
## Remediation
### Patches
- No specific vendor patches are listed, as the issue is rooted in configuration, not necessarily a software bug. Vendors are reportedly working with impacted clients.
### Workarounds
1. **Immediate Action:** Take the systems offline temporarily to prevent unauthorized remote access.
2. **Network Segmentation:** Place all AMS devices behind firewalls and restrict access exclusively to authorized personnel via VPNs.
3. **Authentication Hardening:** Change all default administrator credentials immediately.
4. **MFA:** Implement Multi-Factor Authentication (MFA) on all access interfaces where available.
5. **Updates:** Apply the latest software and firmware updates provided by the AMS vendor.
6. **Data Hygiene:** Purge data pertaining to former employees whose access has not been revoked across all systems.
7. **Encryption:** Ensure that biometric data and PII are stored in encrypted format.
8. **Attack Surface Reduction:** Minimize or disable unnecessary network services running on the AMS interface.
## Detection
- **Indicators of Compromise:** Unusual modifications to access logs, new or deleted employee records, unauthorized entry attempts recorded, or access attempts from unexpected external IP addresses.
- **Detection Methods and Tools:** Network monitoring and vulnerability scanning tools can be used to identify AMS devices responding directly to inbound Internet connections. Reviewing firewall and VPN logs for unauthenticated access attempts directed at AMS management ports is crucial.
## References
- Vendor advisories are implied to be forthcoming or in progress with vendors contacted by researchers.
- Relevant links: (The original article is from BleepingComputer, links provided within the context are generally news/tutorial related, the direct research source is cited as "Modat").