IDS Innomic VibroLine Devices Unintended Device Reset Vulnerability

A vulnerability exists in VibroLine devices running version 5.0 of the Configurator, specifically in the range of 2.1.1340 to 2.1.2486. This vulnerability allows a local attacker to cause a full device reset by using an invalid password reset file via USB. The issue arises from improper validation of input consistency, leading to unintended consequences when the device processes the invalid reset file.

Impact

Exploitation of this vulnerability leads to an unauthorized full device reset, causing all device passwords to be reset and potentially disrupting normal device operations.

Remediation

Users can update the VibroLine Configurator to version 5.1.2730 or later, which includes a fix for this vulnerability. Instructions for downloading the update are available on the IDS Innomic website.