spaceLYnk & Wiser for KNX (formerly homeLYnk)

Schneider Electric Security Notification 11-Aug-20 Document Reference Number – SEVD-2020 -224-02 Page 1 of 3 ## spaceLYnk & Wiser for KNX (formerly homeLYnk) 11 August 2020 ## Overview Schneider Electric is aware of a vulnerability in the spaceLYnk and Wiser for KNX (formerly known as homeLYnk) products. ## Affected Product(s) All hardware versions of: • spaceLYnk • Wiser for KNX (formerly homeLYnk) ## Vulnerability Details CVE ID: CVE-2020-7525 CVSS v3.0 Base Score 7.5 | High | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists which could allow an attacker to guess a password when brute force is used. ## Remediation This vulnerability is fixed in V2.5.1 and is available for download below: spaceLYnk: https://www.se.com/ww/en/product/LSS100200/spacelynk-logic-controller/ Wiser for KNX (formerly homeLYnk): https://www.se.com/ww/en/product/LSS100100/wiser-for-knx-logic-controller/ The following workarounds and mitigations can be applied by customers to reduce the risk: • Keep the spaceLYnk and Wiser for KNX (formerly homeLYnk) devices behind a firewall, create a firewall rule to whitelist only those devices allowed to access spaceLYnk and Wiser for KNX (formerly homeLYnk) devices; do not allow direct access to the internet. • Follow the General Security Recommendations in the section below. Schneider Electric Security Notification 11-Aug-20 Document Reference Number – SEVD-2020 -224-02 Page 2 of 3 ## Product Information Wiser for KNX (formerly known as homeLYnk) is a personalized home automation solution, offering a complete system based on open protocols: KNX, Modbus, BACnet and IP. spaceLYnk allows efficient facility management thanks to the convenient web-based user interface with maintenance information. Product Category - Residential and Small Business