Columbia Weather Systems MicroServer Firmware Secrets Exposure Vulnerability

A vulnerability exists in Columbia Weather Systems MicroServer that allows parts of the system firmware to be copied to an unencrypted external SD card during boot. This firmware transfer includes user and vendor secrets. An attacker could exploit this by using the plaintext secrets to modify the vendor firmware or gain administrative access to the web portal. Additionally, an unused web shell in the MicroServer could be leveraged for unauthorized access.

Impact

Exploitation of this vulnerability could lead to unauthorized modification of vendor firmware, access to admin privileges on the web portal, or limited shell access on the device.

Remediation

Users are advised to update the MicroServer firmware to version MS_4.1_14142 or later. For assistance, contact Columbia Weather Systems Support via email or phone.