Güralp FMUS Series Seismic Monitoring Devices Unauthenticated Telnet Command Injection Vulnerability

A vulnerability exists in all versions of the Güralp FMUS series seismic monitoring devices, which expose an unauthenticated Telnet-based command line interface. This flaw could allow an attacker to modify hardware configurations, manipulate data, or perform a factory reset on the device.

Impact

Exploitation of this vulnerability could lead to unauthorized changes in hardware settings, data manipulation, or a complete factory reset of the device.

Remediation

Güralp has not responded to coordination attempts. Users are encouraged to contact Güralp and keep their systems updated. CISA recommends minimizing network exposure for control system devices, using firewalls to isolate these devices from business networks, and employing secure remote access methods such as Virtual Private Networks (VPNs).