Cleartext transmission of sensitive information in Auto-Maskin DCU-210E
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · CNA. Fix status from CNA. Impact type from CWE-319.
Summary
The Auto-Maskin DCU 210E, RP-210E, and Marine Pro Observer Android App transmit sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors. The devices transmit process control information via unencrypted Modbus communications. Impact: An attacker can exploit this vulnerability to observe information about configurations, settings, what sensors are present and in use, and other information to aid in crafting spoofed messages. Requires access to the network. Affected releases are Auto-Maskin DCU-210E, RP-210E, and Marine Pro Observer Android App. Versions prior to 3.7 on ARMv7.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Auto-Maskin | DCU-210E | 3.7 to before 3.7 | 3.7 | Patch available | CNA |
| Auto-Maskin | RP-210E | 3.7 to before 3.7 | 3.7 | Patch available | CNA |
| Auto-Maskin | Marine Pro Observer Android App | — | — | No fix listed | CNA |
- DCU-210E VendorAuto-Maskin Affected 3.7 to before 3.7 Fixed in 3.7 Patch available CNA
- RP-210E VendorAuto-Maskin Affected 3.7 to before 3.7 Fixed in 3.7 Patch available CNA
- Marine Pro Observer Android App VendorAuto-Maskin Affected — Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:auto-maskin:rp_210e_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Auto-Maskin |
| cpe:2.3:h:arm:arm7:*:*:*:*:*:*:*:* | before 3.7 | Running on | Arm |
| cpe:2.3:h:auto-maskin:rp_210e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Auto-Maskin |
| cpe:2.3:o:auto-maskin:dcu_210e_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Auto-Maskin |
| cpe:2.3:h:auto-maskin:dcu_210e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Auto-Maskin |
| cpe:2.3:a:auto-maskin:marine_pro_observer:-:*:*:*:*:android:*:* | not specified by NVD | Vulnerable | Auto-Maskin |
- cpe:2.3:o:auto-maskin:rp_210e_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Auto-Maskin
- cpe:2.3:h:arm:arm7:*:*:*:*:*:*:*:* Versions before 3.7 Running on ·Arm
- cpe:2.3:h:auto-maskin:rp_210e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Auto-Maskin
- cpe:2.3:o:auto-maskin:dcu_210e_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Auto-Maskin
- cpe:2.3:h:auto-maskin:dcu_210e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Auto-Maskin
- cpe:2.3:a:auto-maskin:marine_pro_observer:-:*:*:*:*:android:*:* Versions not specified by NVD Vulnerable ·Auto-Maskin
Remediation
- Fix · CNA DCU-210E (Auto-Maskin) Fixed in 3.7
- Fix · CNA RP-210E (Auto-Maskin) Fixed in 3.7
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Auto-Maskin DCU-210E, RP-210E 3.7
4 records Highest priority Priority MEDIUM 4 MEDIUM
Other records, highest priority first
- TI-2018-03927 Hard-coded credentials in Auto-Maskin DCU-210EPriority MEDIUM 46
- TI-2018-03930 Cleartext transmission of sensitive information in Auto-Maskin DCU-210EPriority MEDIUM 41
- TI-2018-03928 Origin validation error in Auto-Maskin DCU-210EPriority MEDIUM 41
Timeline
- 2026-10-02 Threatist record created from CVE-2018-5401
- 2026-10-03 Alias added: GHSA-6w6w-jx93-4cwq
References
Advisory 1
More Auto-Maskin Dcu 210e Firmware vulnerabilities
- TI-2018-03930 Cleartext transmission of sensitive information in Auto-Maskin DCU-210E CVSS 3.0CRITICAL 9.1
- TI-2018-03928 Origin validation error in Auto-Maskin DCU-210E CVSS 3.0CRITICAL 9.1
- TI-2019-04612 In Auto-Maskin RP210E Versions 3.7 and prior, DCU210E Versions 3.7 and prior and Marine… CVSS 3.1HIGH 7.5
Sources
- CVE-2018-5401 · CVE Program
- CVE-2018-5401 · NVD
- FIRST EPSS
- GHSA-6w6w-jx93-4cwq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences