High risk security vulnerability discovered in SAUTER CASE Suite building automation software

Exploitation of this vulnerability has the potential to allow unauthorised users to access sensitive information or configuration files, with the ability to impact availability of the affected application.

Applied Risk researcher, Gjoko Krstic, has identified a security vulnerability in the SAUTER CASE Suite, a software package used to handle building automation projects with energy-efficient strategies and methods. The impact of this vulnerability is that an unauthenticated user can craft a malicious XML data file that allows them to access sensitive information or configuration files, potentially impacting the availability of the affected application.

The SAUTER Case Suite is a building management software that is used for project engineering and control functions of building management systems within both office and industrial environments. The application suffers from an XML External Entity (XXE) vulnerability, which can be used to cause a Denial of Service (DoS) condition via a specially crafted XML file.

This vulnerability is classified as high risk and has therefore been given a CVSS (Common Vulnerability Scoring System) of 8.6. Applied Risk has worked alongside SAUTER in the responsible disclosure process, with the vendor releasing a patch within 10 days of disclosure by ICS-CERT on October 15th. It is recommended to organisations utilising the SAUTER CASE Suite building automation software to update to the latest version.