Avation Light Engine Pro Missing Authentication Vulnerability

A vulnerability exists in Avation Light Engine Pro, allowing unauthorized access to its configuration and control interface. This issue arises from a lack of authentication and access controls, potentially enabling an attacker to gain full control of the device. The vulnerability affects all versions of Avation Light Engine Pro.

Impact

Exploitation of this vulnerability could lead to unauthorized control over the affected device.

Remediation

CISA recommends minimizing network exposure for control system devices, ensuring they are not accessible from the internet. Control system networks and remote devices should be located behind firewalls and isolated from business networks. When remote access is necessary, use secure methods such as Virtual Private Networks (VPNs), keeping in mind that VPNs may have vulnerabilities and should be updated to the latest version. Organizations should conduct a proper impact analysis and risk assessment before implementing defensive measures.