CVE-2018-19023

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-01-25 · updated 2026-06-17
Weakness: CWE-294

Description

Hetronic Nova-M prior to verson r161 uses fixed codes that are reproducible by sniffing and re-transmission. This can lead to unauthorized replay of a command, spoofing of an arbitrary message, or keeping the controlled load in a permanent "stop" state.

Affected products

Hetronic Bms-Hl Firmware: before main_r1175 — fixed in main_r1175
Hetronic Dc Mobile Firmware: before main_r515 — fixed in main_r515
Hetronic Es-Can-Hl Firmware: before main_r1864 — fixed in main_r1864
Hetronic Mlc Firmware: before main_r1600 — fixed in main_r1600
Hetronic Nova-M Firmware: before r161 — fixed in r161

How to fix

Upgrade to a fixed version: Hetronic Bms-Hl Firmware main_r1175; Hetronic Dc Mobile Firmware main_r515; Hetronic Es-Can-Hl Firmware main_r1864; Hetronic Mlc Firmware main_r1600; Hetronic Nova-M Firmware r161. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2018-19023 or the next vulnerability affects your stack