Details

The IP-ACM is a network door controller which provides physical access control capabilities including communication with card readers and door lock control. While it can operate independently in cases of network failure, the IP-ACM communicates to an iSTAR Ultra GCM to receive updates to the access control database and respond to user actions like manual door unlock.

The communications between the IP-ACM and the iSTAR Ultra GCM is encrypted with AES 256. However, the IP-ACM v1 uses a fixed key and initialization vector allowing an attacker with knowledge of this key and local network access the ability to decrypt the communication between the IP-ACM and iSTAR Ultra GCM. The encryption is also the only source of authentication for the IP-ACM v1, so an attacker who has compromised this vulnerability can replay commands sent from the iSTAR Ultra GCM to the IP-ACM.

Mitigation:

The hardware capabilities of the initial IP-ACM v1 product does not allow for an update to the firmware to address this issue. Shortly after the initial launch, an updated hardware platform was designed with additional processing and memory to support TLS communication. This second generation of the IP-ACM (IP-ACM v2) hardware and firmware are not susceptible to this vulnerability.