Full Report
Researchers from Modat detailed a significant global security risk stemming from misconfigured and inadequately secured access management systems... The post Modat researchers reveal massive AMS vulnerabilities, putting critical industries at cyber risk appeared first on Industrial Cyber.
Analysis Summary
# Vulnerability: Widespread Internet Exposure and Misconfigurations in Access Management Systems (AMS)
## CVE Details
- CVE ID: Not explicitly provided in the article. This appears to be a broad, configuration, and exposure-based security finding rather than a specific software flaw tied to a CVE.
- CVSS Score: Not explicitly provided.
- CWE: Likely related to **CWE-807: Improper Restriction of Access Within a Component to Only Users with Appropriate Permissions** or **CWE-425: Exposed Path or File**.
## Affected Systems
- Products: Access Management Systems (AMS) used for physical security, often integrated with IT/OT networks.
- Versions: Not specified; vulnerability is due to deployment configuration/exposure.
- Configurations: Systems that are directly exposed to the internet without proper network segregation (e.g., behind firewalls or VPNs).
## Vulnerability Description
A massive global security risk stemming from widespread **misconfiguration and inadequate security** of internet-connected Access Management Systems (AMS). Over 49,000 identified exposed devices showed direct internet connectivity. This exposure leads to the leakage of highly sensitive employee data, including PII (names, IDs, photographs), biometric information, work schedules, and facility access histories. Critically, this compromise grants potential **unauthorized physical access** to buildings and allows the circumvention of physical security measures. Affected sectors include construction, healthcare, education, manufacturing, oil, and government entities.
## Exploitation
- Status: The article implies a high **potential** for exploitation given the exposure, but does not confirm active exploitation in the wild.
- Complexity: The complexity of *discovery* (via scanning) is low, but exploiting the exposure to gain unauthorized access depends on the specific AMS configuration.
- Attack Vector: Primarily **Network** (remote access enabled), leading to **Physical** impact.
## Impact
- Confidentiality: **High** (Exposure of PII, biometric data, work schedules).
- Integrity: **Medium to High** (Potential for manipulation of access logs, though the primary focus is data leakage and physical bypass).
- Availability: **Low to Medium** (Service disruption is not the primary risk, but physical security integrity is compromised).
## Remediation
### Patches
- No specific software patches are listed, as the issue is primarily configuration-related exposure.
### Workarounds
1. **Network Isolation:** Do not connect AMS systems directly to the internet. Place them behind firewalls and utilize VPNs (Virtual Private Networks) for necessary remote access.
2. **Configuration Review:** Immediately audit all AMS installations for internet exposure.
3. **Secure Access Control:** Restrict access to authorized personnel only.
## Detection
- Indicators of Compromise: Anomalous access attempts to AMS backends, unauthorized changes in access permissions, or observed system access originating directly from the public internet.
- Detection Methods and Tools: Use network scanning and asset discovery tools (like those employed by Modat) to continuously monitor for AMS devices broadcasting on public IP addresses. Integrate asset inventory systems to track connected physical security devices.
## References
- Vendor Advisories: Responsible disclosure was initiated by Modat to system owners.
- Relevant Links:
* Disclosure Report: hxxps://www.modat.io/post/doors-wide-open-critical-risks-in-ams