SAUTER Controls Nova 200-220 series (firmware <=3.3-006) with BACnetstac <=4.2.1: Commands execute with no credentials

Impact

Commands execute with no credentials at all, and the only management protocols the device offers are Telnet and FTP - both cleartext. An unauthorized user can log in, change the device configuration and modify the control program. These are HVAC automation stations; whoever holds them holds the air handling and chilled-water sequences they run. The cleartext management path compounds it: any credentials that do exist elsewhere in the building, entered through these devices, are recoverable by passive sniffing on the facility VLAN, which turns one weak controller into a credential source for the rest of the BMS. In a GPU hall the direct consequence is loss of thermal control with a hardware-damage tail; the indirect one is that your entire building-controls credential set should be considered compromised if these devices are present and the network is shared.

Who can reach it

Unauthenticated Telnet/FTP from anywhere on the facility network. There is nothing to bypass. Passive sniffing on the same segment additionally yields any credentials in flight. Internet exposure of Telnet on building controllers is a recurring Shodan finding, so check your external surface for port 23 as well.

What to do

SAUTER's guidance is upgrade to fixed firmware where available and otherwise disable the affected services - but on this generation, disabling Telnet and FTP removes the only management path the device has, which is why sites leave them on. Treat this as effectively unpatchable in place: the durable fix is replacing the controller generation, a capital project with a contractor and per-device downtime. Interim controls: strict VLAN isolation with an allow-list from the supervisor only, switch ACLs blocking 21/23 from everything else, and physical security on the panels. Leased colo: this is landlord equipment, so the honest remediation is contractual - require disclosure of controller make/model/firmware across the mechanical plant and the right to audit the segment.

References