Kiloview N30 Hardcoded TLS Private Key and Certificate Vulnerability Allowing Man-in-the-Middle Attacks

A vulnerability in Kiloview N30 firmware version 2.02.246 has been identified, involving a hardcoded TLS private key and certificate. This flaw allows a malicious adversary to perform a man-in-the-middle attack over the network.

Impact

Exploitation of this vulnerability could lead to a man-in-the-middle attack, allowing an adversary to intercept and potentially alter communications.

Remediation

Users can upgrade to Kiloview N30 firmware version 3.01, which addresses this vulnerability. However, upgrading from version 2.x to 3.01 requires first installing an intermediate upgrade package, N30-9999-upgrade-firmware.