CVE-2021-34572 - CVE House

Status published Medium CVE-2021-34572

Insufficient Verification of Data Authenticity in Enbra EWM (replay attack)

6.5 CVSS

Vulnerability Description

Enbra EWM 1.7.29 does not check for or detect replay attacks sent by wireless M-Bus Security mode 5 devices. Instead timestamps of the sensor are replaced by the time of the readout even if the data is a replay of earlier data.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-34572

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Libor POLČÁK reported to CERT@VDE

References

https://www.fit.vutbr.cz/~polcak/CVE-2021-34572.en

More from Enbra

View All →

CVE-2021-34573

Incorrect calculation in Enbra EWM does not report backflows or no flow events

Medium 6.2

CVE-2021-34571

Hard-coded Credentials in Enbra Wireless M-Bus devices

Medium 6.5

Affected Vendor

Enbra

View all reports →

Affected Software

EWM 1.7.29

Vulnerable Versions:

03.11.2019

Timeline

Official Publish: September 16th, 2021

Last Modified: September 16th, 2024

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weaknesses (CWE)

CWE-345

MITRE ATT&CK TTPs

T1557 Adversary-in-the-Middle

Credential Access

T1071 Application Layer Protocol

Command and Control

T1552 Unsecured Credentials