IDS VibroLine Devices Unauthenticated Configuration Switch Vulnerability via CAN

A vulnerability exists in IDS VibroLine devices running version 5.0 Firmware 2.1.1340 to 2.1.1387 on the VLX1, VLX2, VLX4, VLX6, and VLX8 HD 5.0 models. The vulnerability allows an unauthenticated adjacent attacker to disrupt operations by switching between multiple configuration presets via CAN. This issue could interfere with normal device functions, especially if more than one configuration preset is active.

Impact

Exploitation of this vulnerability could lead to a denial-of-service condition, disrupting normal operations by improperly switching configuration presets.

Remediation

Users can limit access to the CAN bus to trustworthy devices and remove any unnecessary configuration presets. For devices currently running the vulnerable firmware, an update to version 2.1.1866 or later is recommended.