EUVD-2025-209395Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Trusted input validation
|
| Impact | CVSS 9.3 reflects unauthenticated network access enabling packet forgery via sniffed credentials. CWE-807 (reliance on unverified network data) compounds exposure for ICS environments where BASC 20T controls critical infrastructure. No authentication required. Blast radius spans all networked instances; elevated observed exploitation activity signals real-world targeting. |
| Exploit ScenarioDerived | Attacker captures unencrypted BASC 20T network traffic, extracts authentication material, and forges control packets over the network to execute arbitrary commands on the device. No authentication bypass needed; AV:N/PR:N enables direct exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 09, 2026
Session token exposure in Contemporary Controls BASControl20 3.1 building automation controller enables unauthenticated remote attackers to forge authenticated requests via network traffic interception. Exploitation requires attacker ability to sniff network traffic containing authentication credentials, which can then be replayed to execute arbitrary commands with full system privileges. Classified as CWE-807 (untrusted input reliance), this vulnerability permits complete compromise of controller confidentiality, integrity, and availability without user interaction. No public exploit identified at time of analysis.
RemediationAI
No vendor-released patch identified at time of analysis. Contact Contemporary Controls technical support directly via https://www.ccontrols.com/support/contacttech.htm for remediation guidance specific to BASControl20 3.1 deployments. Until patches are available, implement network segmentation to isolate BASControl20 devices from untrusted networks, deploy encrypted communication channels (VPN/TLS) to prevent credential interception, and restrict network access to the controller using firewall rules permitting only authenticated administrative hosts. Monitor CISA advisory ICSA-26-099-01 for updates: https://www.cisa.gov/news-events/ics-advisories/icsa-26-099-01. Consider disabling remote access features if operationally feasible until vendor provides cryptographically secure session management.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Root cause is inadequate session management allowing credential replay attacks (CWE-807). Authentication tokens transmitted over the network lack cryptographic binding or replay protection mechanisms, permitting passive network interception followed by credential reuse. CVSS:4.0 vector confirms unauthenticated network attack (PR:N, AV:N) with no complexity barriers (AC:L, AT:N), yielding high impact across all CIA dimensions for vulnerable component.
Know when Bascontrol20 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Primary rating from Vendor (icscert) · only source for this CVE.
CVSS VectorVendor: icscert
DescriptionCVE.org
An attacker could use data obtained by sniffing the network traffic to forge packets in order to make arbitrary requests to Contemporary Controls BASC 20T.
Executive ViewAI
Contemporary Controls BASControl20 3.1 building automation controllers contain a critical session token exposure vulnerability that allows unauthenticated attackers with network access to intercept credentials and execute arbitrary commands with full system privileges, potentially compromising HVAC, lighting, and facility controls across your infrastructure. This affects any organization using this controller model in networked environments and requires immediate network isolation to prevent compromise of critical building systems.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Implement strict network segmentation-isolate BASControl20 devices on dedicated VLAN with firewall rules restricting inbound/outbound traffic to essential management IPs only; (2) Deploy network intrusion detection (IDS) monitoring on BASControl20 network segments to detect credential sniffing and authentication replay; (3) Enforce encrypted management channels (TLS 1.2+) for all controller communications; (4) Implement network access controls (802.1X) if controller supports authenticated port access; (5) Disable remote management access until patch is available; (6) Monitor controller logs for unexplained command execution or privilege escalation; (7) Maintain ready replacement hardware pending vendor patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB