Origin validation error in Auto-Maskin DCU-210E
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · CNA. Fix status from CNA. Impact type from CWE-346.
Summary
The Auto-Maskin products utilize an undocumented custom protocol to set up Modbus communications with other devices without validating those devices. The originating device sends a message in plaintext, 48:65:6c:6c:6f:20:57:6f:72:6c:64, "Hello World" over UDP ports 44444-44446 to the broadcast address for the LAN. Without verification devices respond to any of these broadcast messages on the LAN with a plaintext reply over UDP containing the device model and firmware version. Following this exchange the devices allow Modbus transmissions between the two devices on the standard Modbus port 502 TCP. Impact: An attacker can exploit this vulnerability to send arbitrary messages to any DCU or RP device through spoofing or replay attacks as long as they have access to the network. Affected releases are Auto-Maskin DCU-210E RP-210E: Versions prior to 3.7 on ARMv7.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Auto-Maskin | DCU-210E | 3.7 to before 3.7 | 3.7 | Patch available | CNA |
| Auto-Maskin | RP-210E | 3.7 to before 3.7 | 3.7 | Patch available | CNA |
| Auto-Maskin | Marine Pro Observer Android App | — | — | No fix listed | CNA |
- DCU-210E VendorAuto-Maskin Affected 3.7 to before 3.7 Fixed in 3.7 Patch available CNA
- RP-210E VendorAuto-Maskin Affected 3.7 to before 3.7 Fixed in 3.7 Patch available CNA
- Marine Pro Observer Android App VendorAuto-Maskin Affected — Fixed in — No fix listed CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:auto-maskin:rp_210e_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Auto-Maskin |
| cpe:2.3:h:arm:arm7:*:*:*:*:*:*:*:* | before 3.7 | Running on | Arm |
| cpe:2.3:h:auto-maskin:rp_210e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Auto-Maskin |
| cpe:2.3:o:auto-maskin:dcu_210e_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Auto-Maskin |
| cpe:2.3:h:auto-maskin:dcu_210e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Auto-Maskin |
- cpe:2.3:o:auto-maskin:rp_210e_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Auto-Maskin
- cpe:2.3:h:arm:arm7:*:*:*:*:*:*:*:* Versions before 3.7 Running on ·Arm
- cpe:2.3:h:auto-maskin:rp_210e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Auto-Maskin
- cpe:2.3:o:auto-maskin:dcu_210e_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Auto-Maskin
- cpe:2.3:h:auto-maskin:dcu_210e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Auto-Maskin
Remediation
- Fix · CNA DCU-210E (Auto-Maskin) Fixed in 3.7
- Fix · CNA RP-210E (Auto-Maskin) Fixed in 3.7
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Auto-Maskin DCU-210E, RP-210E 3.7
4 records Highest priority Priority MEDIUM 4 MEDIUM
Other records, highest priority first
- TI-2018-03927 Hard-coded credentials in Auto-Maskin DCU-210EPriority MEDIUM 46
- TI-2018-03930 Cleartext transmission of sensitive information in Auto-Maskin DCU-210EPriority MEDIUM 41
- TI-2018-03929 Cleartext transmission of sensitive information in Auto-Maskin DCU-210EPriority MEDIUM 41
Timeline
- 2026-10-02 Threatist record created from CVE-2018-5400
- 2026-10-03 Alias added: GHSA-hmx9-h7xx-529h
References
Advisory 1
More Auto-Maskin Dcu 210e Firmware vulnerabilities
- TI-2018-03930 Cleartext transmission of sensitive information in Auto-Maskin DCU-210E CVSS 3.0CRITICAL 9.1
- TI-2018-03929 Cleartext transmission of sensitive information in Auto-Maskin DCU-210E CVSS 3.0CRITICAL 9.1
- TI-2019-04612 In Auto-Maskin RP210E Versions 3.7 and prior, DCU210E Versions 3.7 and prior and Marine… CVSS 3.1HIGH 7.5
Sources
- CVE-2018-5400 · CVE Program
- CVE-2018-5400 · NVD
- FIRST EPSS
- GHSA-hmx9-h7xx-529h · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences