ENTTEC Lighting Controllers (Update A)
Plan Patch8.8ICS-CERT ICSA-20-177-01Jun 25, 2020
Attack VectorNetwork
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
ENTTEC lighting controllers contain multiple vulnerabilities (CWE-321, CWE-79, CWE-284, CWE-732) that allow authorized users to escape privilege boundaries, inject malicious code, and execute arbitrary commands with root privileges via SSH/SCP access. Affected devices include Datagate Mk2, E-Streamer Mk2, Pixelator, and Storm 24 with firmware versions up to 70044_update_05032019-482. Successful exploitation enables full system compromise including reading, writing, and executing files in system directories.
What this means
What could happen
An attacker with login credentials could gain SSH/SCP access to lighting controllers and execute arbitrary commands with root privileges, potentially disrupting stage lighting, venue automation, and integrated building control systems.
Who's at risk
Venues, theaters, concert halls, broadcast facilities, and events production systems using ENTTEC lighting control hardware. The Datagate Mk2, Storm 24, and Pixelator are active products requiring firmware updates. The E-Streamer Mk2 is end-of-life and no longer supported.
How it could be exploited
An attacker with valid user credentials exploits weak access controls (CWE-284, CWE-732) to gain SSH/SCP access to the device. Once authenticated, the attacker can inject malicious code and execute commands with root privileges to read, write, or modify system files and device behavior.
Prerequisites
- Valid user credentials for SSH/SCP login
- Network access to the device on SSH port (typically 22)
- Device must be reachable from the attacker's network or accessible via exposed management interface
remotely exploitable (requires network access and credentials)authentication required (valid SSH credentials)low complexity attackaffects automation and control systemsno fix available for E-Streamer Mk2 (end-of-life)weak access controls and permission misconfigurations
Exploitability
Moderate exploit probability (EPSS 1.0%)
Affected products (4)
3 with fix1 EOL
ProductAffected VersionsFix Status
Datagate Mk2: firmware≤ 70044 update 05032019-482RevB (June 2020) or newer
E-Streamer Mk2 (End of Life): firmware≤ 70044 update 05032019-482No fix (EOL)
Storm 24: firmware≤ 70044 update 05032019-482RevB (June 2020) or newer
Pixelator: firmware≤ 70044 update 05032019-482RevB (June 2020) or newer
Remediation & Mitigation
0/6
Do now
0/2WORKAROUNDPlace all lighting controller devices behind firewalls and restrict network access to management ports from engineering workstations only
HARDENINGEnsure devices are not directly accessible from the Internet; use firewall rules to block inbound access
Schedule — requires maintenance window
0/3Patching may require device reboot — plan for process interruption
HOTFIXUpdate Datagate Mk2, Storm 24, and Pixelator devices to RevB (June 2020) firmware or newer
HARDENINGLock device front panel menu after firmware update to restrict local configuration access
HARDENINGIf remote access is required, configure VPN for secure management traffic only
Long-term hardening
0/1HOTFIXE-Streamer Mk2 (end-of-life) units should be upgraded to S-PLAY or replaced with current product line
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/8a76e558-8fab-4eac-bf6e-60c89822f5ba