A Critical Flaw in a Building Controller's Firmware Update

CERT@VDE published advisory VDE-2026-093 on 1 September, covering SAUTER modulo 6 and EY-modulo 5 building controllers. The issue, CVE-2026-78319, carries a CVSS v3.1 base score of 9.8 with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network reachable, low complexity, no privileges, no user interaction, and total loss of confidentiality, integrity and availability.

The weakness is a time-of-check time-of-use race condition, CWE-367, in a service that handles the firmware update process. TOCTOU bugs turn on a gap between validation and use: the code checks that something is acceptable, then acts on it a moment later, and an attacker who can change it in between gets their content used with the earlier check's blessing. In an update service the consequence is direct — an unauthenticated remote attacker can bypass security mechanisms and execute unauthorized code, giving complete control of the controller.

Affected versions are ecos504 (EY-RC504F***) and ecos505 (EY-RC505F***) below 7.0.0, and modu612-LC (EY6LC12F011), modu660-AS (EY6AS60F011) and modu680-AS (EY6AS80F021) below 4.0.0. Remediation is to update the ecos units to 7.0.0 or later and the modu series to 4.0.0 or later, with local SAUTER representatives supporting the upgrade. The vulnerability came through coordinated disclosure, credited to CERT@VDE and the organisers of the Cyberdefence Campus Domotics Hackathon 2026.

Building automation deserves more attention than it gets from OT security programmes, and this advisory is a compact illustration of why. These controllers run heating, ventilation and air conditioning in commercial and industrial buildings — including the buildings that house the plant and the data rooms. They are frequently commissioned by a contractor rather than an operations team, rarely appear on an OT asset inventory, and are often on a network that somebody assumed was isolated because it carries nothing but building services. A device that can be taken over remotely with no credentials is a foothold on that network regardless of what it controls.

The practical follow-up is inventory rather than patching alone. Anyone with SAUTER modulo equipment should establish which firmware versions are running, then ask the more uncomfortable question of what else sits on the same segment — which is exactly the exercise the UK's NCSC asked operators to run last week when it warned against assuming OT is unreachable from the internet.