ICS Advisory: Commend WS203VICM

Summary:

A security vulnerability has been identified in Commend's WS203VICM video door station, which allows an attacker to exploit three vulnerabilities: Argument Injection, Improper Access Control, and Weak Encoding for Password. The vulnerabilities have a CVSS score of 9.4, 8.6, and 5.7, respectively. Successful exploitation can allow an attacker to obtain sensitive information or force the system to restart. Commend has released a new firmware version WS-CM 2.0 to address the first two issues. CISA recommends minimizing network exposure, isolating control system networks, and using secure remote access methods to minimize the risk of exploitation. No known public exploitation has been reported.