Güralp Systems FMUS Series and MIN Series Devices (Update B)

An attacker could remotely reset seismic monitoring or digitizing equipment, alter configuration settings, or corrupt recorded data without needing any credentials, disrupting critical monitoring operations and data integrity.

Water utilities and seismic monitoring networks using Güralp FMUS Series Seismic Monitoring Devices or MIN Series Digitizing Devices (including Fortimus and Certimus variants) for earthquake detection, hydrophone arrays, or other geophysical monitoring are affected. Any facility using these devices on networks accessible from untrusted sources faces risk.

An attacker with network access to the device sends a Telnet connection request to the device's Telnet port (typically port 23). The device accepts the connection without requiring login credentials. The attacker then issues commands through the unauthenticated Telnet session to modify configurations, manipulate data, or factory reset the device.