Read the docs
TI-2018-03930 Aliases CVE-2018-5402GHSA-g66x-xcf8-6hg7

Cleartext transmission of sensitive information in Auto-Maskin DCU-210E

Priority MEDIUM 41CWE-319Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA. Impact type from CWE-319.

Summary

The Auto-Maskin DCU 210E, RP-210E, and Marine Pro Observer Android App use an embedded webserver that uses unencrypted plaintext for the transmission of the administrator PIN Impact: An attacker once authenticated can change configurations, upload new configuration files, and upload executable code via file upload for firmware updates. Requires access to the network. Affected releases are Auto-Maskin DCU-210E, RP-210E, and the Marine Pro Observer Android App. Versions prior to 3.7 on ARMv7.

Why it matters now

EPSS 0.00883 59th percentileScored 2026-11-07
Fix Fixed DCU-210E (Auto-Maskin): 3.7RP-210E (Auto-Maskin): 3.7

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Auto-MaskinDCU-210E3.7 to before 3.73.7Patch availableCNA
Auto-MaskinRP-210E3.7 to before 3.73.7Patch availableCNA
  • DCU-210E VendorAuto-Maskin Affected 3.7 to before 3.7 Fixed in 3.7 Patch available CNA
  • RP-210E VendorAuto-Maskin Affected 3.7 to before 3.7 Fixed in 3.7 Patch available CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:o:auto-maskin:rp_210e_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableAuto-Maskin
cpe:2.3:h:arm:arm7:*:*:*:*:*:*:*:*before 3.7Running onArm
cpe:2.3:h:auto-maskin:rp_210e:-:*:*:*:*:*:*:*not specified by NVDRunning onAuto-Maskin
cpe:2.3:o:auto-maskin:dcu_210e_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableAuto-Maskin
cpe:2.3:h:auto-maskin:dcu_210e:-:*:*:*:*:*:*:*not specified by NVDRunning onAuto-Maskin
cpe:2.3:a:auto-maskin:marine_pro_observer:-:*:*:*:*:android:*:*not specified by NVDVulnerableAuto-Maskin
  • cpe:2.3:o:auto-maskin:rp_210e_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Auto-Maskin
  • cpe:2.3:h:arm:arm7:*:*:*:*:*:*:*:* Versions before 3.7 Running on ·Arm
  • cpe:2.3:h:auto-maskin:rp_210e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Auto-Maskin
  • cpe:2.3:o:auto-maskin:dcu_210e_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Auto-Maskin
  • cpe:2.3:h:auto-maskin:dcu_210e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Auto-Maskin
  • cpe:2.3:a:auto-maskin:marine_pro_observer:-:*:*:*:*:android:*:* Versions not specified by NVD Vulnerable ·Auto-Maskin

Remediation

  • Fix · CNA DCU-210E (Auto-Maskin) Fixed in 3.7
  • Fix · CNA RP-210E (Auto-Maskin) Fixed in 3.7

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Auto-Maskin DCU-210E, RP-210E 3.7

    4 records Highest priority Priority MEDIUM 4 MEDIUM

    Other records, highest priority first

    • TI-2018-03927 Hard-coded credentials in Auto-Maskin DCU-210EPriority MEDIUM 46
    • TI-2018-03929 Cleartext transmission of sensitive information in Auto-Maskin DCU-210EPriority MEDIUM 41
    • TI-2018-03928 Origin validation error in Auto-Maskin DCU-210EPriority MEDIUM 41
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-5402
  2. 2026-10-03 Alias added: GHSA-g66x-xcf8-6hg7

References

Advisory 1

Other 1

  • TI-2018-03929 Cleartext transmission of sensitive information in Auto-Maskin DCU-210E CVSS 3.0CRITICAL 9.1
  • TI-2018-03928 Origin validation error in Auto-Maskin DCU-210E CVSS 3.0CRITICAL 9.1
  • TI-2019-04612 In Auto-Maskin RP210E Versions 3.7 and prior, DCU210E Versions 3.7 and prior and Marine… CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences