SCHUTZWERK-SA-2025-001: Authentication Bypass for SafeLine SL6 and SL6+
Jan Hüber via Fulldisclosure ·
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Authentication Bypass for SafeLine SL6 and SL6+ =============================================== gain unauthorized administrative access to the device configuration. Metadata ======== * Affected product: SafeLine SL6/SL6+ * Affected version: Introduced in version 4.82, patched in version 4.97 * Vendor: SafeLine * Problem type(s): CWE-305 Authentication bypass by primary weakness * CVE ID: CVE-2025-4994 * CVE URL: https://www.cve.org/CVERecord?id=CVE-2025-4994 * CVSS 4.0 score: 8.7 * Advisory URL: https://www.schutzwerk.com/blog/schutzwerk-sa-2025-001/ Details ======= depending on the "Auto Enable BLE" configuration setting: by a configurable PIN. enabled by a reboot. to the target device and is fully reproducible. Risk ==== an incident. Workaround ========== interface. Solution/Mitigation =================== should be applied. Timeline ======== * 2025-03-28 Vulnerability discovered * 2025-04-14 Initial contact with vendor * 2025-04-16 Vulnerability reported to technical support of vendor * 2025-05-08 Follow-up meeting was canceled by vendor * 2025-05-16 Initial contact with CTO of vendor * 2025-05-28 Vulnerability presented to CTO of vendor * 2025-06-16 Vendor informed SCHUTZWERK that the patch is currently tested * 2025-07-03 Follow-up meeting was canceled by vendor * 2025-07-31 Follow-up meeting was requested by SCHUTZWERK * 2025-08-21 Vendor informed SCHUTZWERK that the patch was postponed * 2025-08-28 Vendor informed SCHUTZWERK that the patch is currently tested * 2025-12-19 Vendor informed SCHUTZWERK that the patch was released scheduled maintenance windows * 2026-06-19 Advisory released by SCHUTZWERK Credits ======= The vulnerability was discovered by Jan Hüber of SCHUTZWERK GmbH -----BEGIN PGP SIGNATURE----- iQJOBAEBCgA4FiEEgLsg7Oj/wY3LSF87GrXfkTIXLrsFAmpLjrQaHGFkdmlzb3Jp ZXNAc2NodXR6d2Vyay5jb20ACgkQGrXfkTIXLruNEA/+IiLtH9rqkwhZA3H0qWQp Z6xH/M7Som+OkCn/qgZ7khBKi2qsC0jdA7ePf/D3LY2VlgA9Y60fAETXarNj2X/y KgB80TjrPRwBhPhdZKxhn14DCPjLANGVYVDanfR0oQmRzZ8aEjb9No6G04nb+qCV u7c1aD5Hl0vJRI7AAgkHjz1etgsYm7MKkJYHxhCuJFw2B4XpPjk9TREgofdC3FLk VkO5xMRUysMy9Sgy8qzesSySX5UHKoPVtndo/EVvDsUJccsIL6WdE4z4odMJ9cRE r8CX6LAnyhfktgDf8eOgzysfdkYl//0KO1IIGF8ghLqRDpgWkMZTHc2/GXPnPYL1 3uIXI7vG8jGJ99fIijocplug9BAnQnK+w7PBJOzroWMOQC7zJWwy6gL2H/vYIatp FQFlgF5DnMBdjWX80Gu5CIDPYIVlXW15k7TNF/k5XUW3Uh6/uk8FTLgzPFsR707j XsWPKk7XICiizJDv2su8rmTtCpPtgHhC0HUoJa6eVBj+37l4EuPS0jpYEByfkmNY e+eka/F0kF4FzxAp2jWfE4A+QLlP6GGgZSLlfybVgvsjUe468intIDHaR9CPlv74 DtLWZ3zr4OXTare4hm7F0dLN80WAG3A6ELsrqGknaKvD4ePaSBLdkL8q9tKZIQL5 MUv9NZtj3B224OsNyt8EhjA= =JAMF -----END PGP SIGNATURE----- -- SCHUTZWERK GmbH, Pfarrer-Weiß-Weg 12, 89077 Ulm, Germany Zertifiziert / Certified ISO 27001, 9001 and TISAX Phone +49 731 977 191 0 advisories () schutzwerk com / www.schutzwerk.com Geschäftsführer / Managing Directors: Jakob Pietzka, Michael Schäfer Amtsgericht Ulm / HRB 727391 Datenschutz / Data Protection www.schutzwerk.com/datenschutz _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/