All Bachmann M1 System Processor Modules - Use of Password Hash with Insufficient Computational Effort
Priority MEDIUM 42CWE-916Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
The affected Bachmann Electronic M-Base Controllers of version MSYS v1.06.14 and later use weak cryptography to protect device passwords. Affected controllers that are actively supported include MX207, MX213, MX220, MC206, MC212, MC220, and MH230 hardware controllers, and affected end-of-life controller include MC205, MC210, MH212, ME203, CS200, MP213, MP226, MPC240, MPC265, MPC270, MPC293, MPE270, and CPC210 hardware controllers. Security Level 0 is set at default from the manufacturer, which could allow an unauthenticated remote attacker to gain access to the password hashes. Security Level 4 is susceptible if an authenticated remote attacker or an unauthenticated person with physical access to the device reads and decrypts the password to conduct further attacks.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00882 59th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Bachmann Electronic, GmbH | M1 Hardware Controller MX207 | MSYS v1.06.14 and later | — | No fix listed | CNA |
| Bachmann Electronic, GmbH | M1 Hardware Controller MX213 | MSYS v1.06.14 and later | — | No fix listed | CNA |
| Bachmann Electronic, GmbH | M1 Hardware Controller MX220 | MSYS v1.06.14 and later | — | No fix listed | CNA |
| Bachmann Electronic, GmbH | M1 Hardware Controller MC206 | MSYS v1.06.14 and later | — | No fix listed | CNA |
| Bachmann Electronic, GmbH | M1 Hardware Controller MC212 | MSYS v1.06.14 and later | — | No fix listed | CNA |
| Bachmann Electronic, GmbH | M1 Hardware Controller MC220 | MSYS v1.06.14 and later | — | No fix listed | CNA |
| Bachmann Electronic, GmbH | M1 Hardware Controller MH230 | MSYS v1.06.14 and later | — | No fix listed | CNA |
| Bachmann Electronic, GmbH | M1 Hardware Controller MC205 | MSYS v1.06.14 and later | — | No fix listed | CNA |
| Bachmann Electronic, GmbH | M1 Hardware Controller MC210 | MSYS v1.06.14 and later | — | No fix listed | CNA |
| Bachmann Electronic, GmbH | M1 Hardware Controller MH212 | MSYS v1.06.14 and later | — | No fix listed | CNA |
| Bachmann Electronic, GmbH | M1 Hardware Controller ME203 | MSYS v1.06.14 and later | — | No fix listed | CNA |
| Bachmann Electronic, GmbH | M1 Hardware Controller CS200 | MSYS v1.06.14 and later | — | No fix listed | CNA |
| Bachmann Electronic, GmbH | M1 Hardware Controller MP213 | MSYS v1.06.14 and later | — | No fix listed | CNA |
| Bachmann Electronic, GmbH | M1 Hardware Controller MP226 | MSYS v1.06.14 and later | — | No fix listed | CNA |
| Bachmann Electronic, GmbH | M1 Hardware Controller MPC240 | MSYS v1.06.14 and later | — | No fix listed | CNA |
| Bachmann Electronic, GmbH | M1 Hardware Controller MPC265 | MSYS v1.06.14 and later | — | No fix listed | CNA |
| Bachmann Electronic, GmbH | M1 Hardware Controller MPC270 | MSYS v1.06.14 and later | — | No fix listed | CNA |
| Bachmann Electronic, GmbH | M1 Hardware Controller MPC293 | MSYS v1.06.14 and later | — | No fix listed | CNA |
| Bachmann Electronic, GmbH | M1 Hardware Controller MPE270 | MSYS v1.06.14 and later | — | No fix listed | CNA |
| Bachmann Electronic, GmbH | M1 Hardware Controller CPC210 | MSYS v1.06.14 and later | — | No fix listed | CNA |
- M1 Hardware Controller MX207 VendorBachmann Electronic, GmbH Affected MSYS v1.06.14 and later Fixed in — No fix listed CNA
- M1 Hardware Controller MX213 VendorBachmann Electronic, GmbH Affected MSYS v1.06.14 and later Fixed in — No fix listed CNA
- M1 Hardware Controller MX220 VendorBachmann Electronic, GmbH Affected MSYS v1.06.14 and later Fixed in — No fix listed CNA
- M1 Hardware Controller MC206 VendorBachmann Electronic, GmbH Affected MSYS v1.06.14 and later Fixed in — No fix listed CNA
- M1 Hardware Controller MC212 VendorBachmann Electronic, GmbH Affected MSYS v1.06.14 and later Fixed in — No fix listed CNA
- M1 Hardware Controller MC220 VendorBachmann Electronic, GmbH Affected MSYS v1.06.14 and later Fixed in — No fix listed CNA
- M1 Hardware Controller MH230 VendorBachmann Electronic, GmbH Affected MSYS v1.06.14 and later Fixed in — No fix listed CNA
- M1 Hardware Controller MC205 VendorBachmann Electronic, GmbH Affected MSYS v1.06.14 and later Fixed in — No fix listed CNA
- M1 Hardware Controller MC210 VendorBachmann Electronic, GmbH Affected MSYS v1.06.14 and later Fixed in — No fix listed CNA
- M1 Hardware Controller MH212 VendorBachmann Electronic, GmbH Affected MSYS v1.06.14 and later Fixed in — No fix listed CNA
- M1 Hardware Controller ME203 VendorBachmann Electronic, GmbH Affected MSYS v1.06.14 and later Fixed in — No fix listed CNA
- M1 Hardware Controller CS200 VendorBachmann Electronic, GmbH Affected MSYS v1.06.14 and later Fixed in — No fix listed CNA
- M1 Hardware Controller MP213 VendorBachmann Electronic, GmbH Affected MSYS v1.06.14 and later Fixed in — No fix listed CNA
- M1 Hardware Controller MP226 VendorBachmann Electronic, GmbH Affected MSYS v1.06.14 and later Fixed in — No fix listed CNA
- M1 Hardware Controller MPC240 VendorBachmann Electronic, GmbH Affected MSYS v1.06.14 and later Fixed in — No fix listed CNA
- M1 Hardware Controller MPC265 VendorBachmann Electronic, GmbH Affected MSYS v1.06.14 and later Fixed in — No fix listed CNA
- M1 Hardware Controller MPC270 VendorBachmann Electronic, GmbH Affected MSYS v1.06.14 and later Fixed in — No fix listed CNA
- M1 Hardware Controller MPC293 VendorBachmann Electronic, GmbH Affected MSYS v1.06.14 and later Fixed in — No fix listed CNA
- M1 Hardware Controller MPE270 VendorBachmann Electronic, GmbH Affected MSYS v1.06.14 and later Fixed in — No fix listed CNA
- M1 Hardware Controller CPC210 VendorBachmann Electronic, GmbH Affected MSYS v1.06.14 and later Fixed in — No fix listed CNA
CPE configurations NVD · 40
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:bachmann:mx207_firmware:*:*:*:*:*:*:*:* | 1.06.14 | Vulnerable | Bachmann |
| cpe:2.3:h:bachmann:mx207:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Bachmann |
| cpe:2.3:o:bachmann:mx213_firmware:*:*:*:*:*:*:*:* | 1.06.14 | Vulnerable | Bachmann |
| cpe:2.3:h:bachmann:mx213:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Bachmann |
| cpe:2.3:o:bachmann:mx220_firmware:*:*:*:*:*:*:*:* | 1.06.14 | Vulnerable | Bachmann |
| cpe:2.3:h:bachmann:mx220:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Bachmann |
| cpe:2.3:o:bachmann:mc206_firmware:*:*:*:*:*:*:*:* | 1.06.14 | Vulnerable | Bachmann |
| cpe:2.3:h:bachmann:mc206:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Bachmann |
| cpe:2.3:o:bachmann:mc212_firmware:*:*:*:*:*:*:*:* | 1.06.14 | Vulnerable | Bachmann |
| cpe:2.3:h:bachmann:mc212:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Bachmann |
- cpe:2.3:o:bachmann:mx207_firmware:*:*:*:*:*:*:*:* Versions 1.06.14 Vulnerable ·Bachmann
- cpe:2.3:h:bachmann:mx207:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bachmann
- cpe:2.3:o:bachmann:mx213_firmware:*:*:*:*:*:*:*:* Versions 1.06.14 Vulnerable ·Bachmann
- cpe:2.3:h:bachmann:mx213:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bachmann
- cpe:2.3:o:bachmann:mx220_firmware:*:*:*:*:*:*:*:* Versions 1.06.14 Vulnerable ·Bachmann
- cpe:2.3:h:bachmann:mx220:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bachmann
- cpe:2.3:o:bachmann:mc206_firmware:*:*:*:*:*:*:*:* Versions 1.06.14 Vulnerable ·Bachmann
- cpe:2.3:h:bachmann:mc206:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bachmann
- cpe:2.3:o:bachmann:mc212_firmware:*:*:*:*:*:*:*:* Versions 1.06.14 Vulnerable ·Bachmann
- cpe:2.3:h:bachmann:mc212:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bachmann
Show 30 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:bachmann:mc220_firmware:*:*:*:*:*:*:*:* | 1.06.14 | Vulnerable | Bachmann |
| cpe:2.3:h:bachmann:mc220:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Bachmann |
| cpe:2.3:o:bachmann:mh230_firmware:*:*:*:*:*:*:*:* | 1.06.14 | Vulnerable | Bachmann |
| cpe:2.3:h:bachmann:mh230:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Bachmann |
| cpe:2.3:o:bachmann:mc205_firmware:*:*:*:*:*:*:*:* | 1.06.14 | Vulnerable | Bachmann |
| cpe:2.3:h:bachmann:mc205:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Bachmann |
| cpe:2.3:o:bachmann:mc210_firmware:*:*:*:*:*:*:*:* | 1.06.14 | Vulnerable | Bachmann |
| cpe:2.3:h:bachmann:mc210:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Bachmann |
| cpe:2.3:o:bachmann:mh212_firmware:*:*:*:*:*:*:*:* | 1.06.14 | Vulnerable | Bachmann |
| cpe:2.3:h:bachmann:mh212:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Bachmann |
| cpe:2.3:o:bachmann:me203_firmware:*:*:*:*:*:*:*:* | 1.06.14 | Vulnerable | Bachmann |
| cpe:2.3:h:bachmann:me203:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Bachmann |
| cpe:2.3:o:bachmann:cs200_firmware:*:*:*:*:*:*:*:* | 1.06.14 | Vulnerable | Bachmann |
| cpe:2.3:h:bachmann:cs200:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Bachmann |
| cpe:2.3:o:bachmann:mp213_firmware:*:*:*:*:*:*:*:* | 1.06.14 | Vulnerable | Bachmann |
| cpe:2.3:h:bachmann:mp213:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Bachmann |
| cpe:2.3:o:bachmann:mp226_firmware:*:*:*:*:*:*:*:* | 1.06.14 | Vulnerable | Bachmann |
| cpe:2.3:h:bachmann:mp226:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Bachmann |
| cpe:2.3:o:bachmann:mpc240_firmware:*:*:*:*:*:*:*:* | 1.06.14 | Vulnerable | Bachmann |
| cpe:2.3:h:bachmann:mpc240:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Bachmann |
| cpe:2.3:o:bachmann:mpc265_firmware:*:*:*:*:*:*:*:* | 1.06.14 | Vulnerable | Bachmann |
| cpe:2.3:h:bachmann:mpc265:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Bachmann |
| cpe:2.3:o:bachmann:mpc270_firmware:*:*:*:*:*:*:*:* | 1.06.14 | Vulnerable | Bachmann |
| cpe:2.3:h:bachmann:mpc270:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Bachmann |
| cpe:2.3:o:bachmann:mpc293_firmware:*:*:*:*:*:*:*:* | 1.06.14 | Vulnerable | Bachmann |
| cpe:2.3:h:bachmann:mpc293:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Bachmann |
| cpe:2.3:o:bachmann:mpe270_firmware:*:*:*:*:*:*:*:* | 1.06.14 | Vulnerable | Bachmann |
| cpe:2.3:h:bachmann:mpe270:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Bachmann |
| cpe:2.3:o:bachmann:cpc210_firmware:*:*:*:*:*:*:*:* | 1.06.14 | Vulnerable | Bachmann |
| cpe:2.3:h:bachmann:cpc210:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Bachmann |
- cpe:2.3:o:bachmann:mc220_firmware:*:*:*:*:*:*:*:* Versions 1.06.14 Vulnerable ·Bachmann
- cpe:2.3:h:bachmann:mc220:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bachmann
- cpe:2.3:o:bachmann:mh230_firmware:*:*:*:*:*:*:*:* Versions 1.06.14 Vulnerable ·Bachmann
- cpe:2.3:h:bachmann:mh230:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bachmann
- cpe:2.3:o:bachmann:mc205_firmware:*:*:*:*:*:*:*:* Versions 1.06.14 Vulnerable ·Bachmann
- cpe:2.3:h:bachmann:mc205:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bachmann
- cpe:2.3:o:bachmann:mc210_firmware:*:*:*:*:*:*:*:* Versions 1.06.14 Vulnerable ·Bachmann
- cpe:2.3:h:bachmann:mc210:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bachmann
- cpe:2.3:o:bachmann:mh212_firmware:*:*:*:*:*:*:*:* Versions 1.06.14 Vulnerable ·Bachmann
- cpe:2.3:h:bachmann:mh212:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bachmann
- cpe:2.3:o:bachmann:me203_firmware:*:*:*:*:*:*:*:* Versions 1.06.14 Vulnerable ·Bachmann
- cpe:2.3:h:bachmann:me203:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bachmann
- cpe:2.3:o:bachmann:cs200_firmware:*:*:*:*:*:*:*:* Versions 1.06.14 Vulnerable ·Bachmann
- cpe:2.3:h:bachmann:cs200:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bachmann
- cpe:2.3:o:bachmann:mp213_firmware:*:*:*:*:*:*:*:* Versions 1.06.14 Vulnerable ·Bachmann
- cpe:2.3:h:bachmann:mp213:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bachmann
- cpe:2.3:o:bachmann:mp226_firmware:*:*:*:*:*:*:*:* Versions 1.06.14 Vulnerable ·Bachmann
- cpe:2.3:h:bachmann:mp226:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bachmann
- cpe:2.3:o:bachmann:mpc240_firmware:*:*:*:*:*:*:*:* Versions 1.06.14 Vulnerable ·Bachmann
- cpe:2.3:h:bachmann:mpc240:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bachmann
- cpe:2.3:o:bachmann:mpc265_firmware:*:*:*:*:*:*:*:* Versions 1.06.14 Vulnerable ·Bachmann
- cpe:2.3:h:bachmann:mpc265:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bachmann
- cpe:2.3:o:bachmann:mpc270_firmware:*:*:*:*:*:*:*:* Versions 1.06.14 Vulnerable ·Bachmann
- cpe:2.3:h:bachmann:mpc270:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bachmann
- cpe:2.3:o:bachmann:mpc293_firmware:*:*:*:*:*:*:*:* Versions 1.06.14 Vulnerable ·Bachmann
- cpe:2.3:h:bachmann:mpc293:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bachmann
- cpe:2.3:o:bachmann:mpe270_firmware:*:*:*:*:*:*:*:* Versions 1.06.14 Vulnerable ·Bachmann
- cpe:2.3:h:bachmann:mpe270:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bachmann
- cpe:2.3:o:bachmann:cpc210_firmware:*:*:*:*:*:*:*:* Versions 1.06.14 Vulnerable ·Bachmann
- cpe:2.3:h:bachmann:cpc210:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bachmann
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-16231
- 2026-10-03 Alias added: GHSA-hqr7-c67h-hjrc
References
Sources
- CVE-2020-16231 · CVE Program
- CVE-2020-16231 · NVD
- FIRST EPSS
- GHSA-hqr7-c67h-hjrc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences