CVE-2025-13926

The attacker monitors network traffic (sniffing) and obtains data transmitted to the BASC 20T device. Based on the collected information, the attacker constructs spoofed network packets that imitate legitimate requests. The device does not sufficiently verify the authenticity of received packets (CWE-807: Reliance on Untrusted Inputs in a Security Decision), which allows the attacker to perform arbitrary operations without possessing valid authentication credentials.

An attacker can send arbitrary requests to the BASC 20T device, which may result in unauthorized modification of its configuration or behavior, and consequently loss of data integrity and confidentiality as well as device availability in the industrial (OT) environment.

Patches available from the manufacturer should be applied according to the references. For detailed information about updates, contact Contemporary Controls technical support at the address indicated in the references. As a temporary measure, network segmentation is recommended, restricting device access to trusted hosts only, and monitoring network traffic for anomalies.

Contemporary Controls BASC 20T — specific firmware/software versions indicated in the manufacturer's references and CISA guide (ICSA-26-099-01).