CVE-2025-46352: CS5000 Fire Panel Auth Bypass Vulnerability

CVE-2025-46352 Overview

The CS5000 Fire Panel contains a critical security vulnerability stemming from hard-coded credentials embedded within the VNC server binary. This password is visible as a plaintext string within the binary responsible for running VNC services, and critically, cannot be changed by end users or administrators. Any attacker with knowledge of this static password can gain unauthorized remote access to fire panel controls through VNC, potentially compromising life-safety systems.

Critical Impact
Attackers with the hard-coded password can remotely access and manipulate fire panel operations, potentially disabling fire detection and suppression systems and creating serious safety hazards in protected facilities.

Affected Products

Consilium CS5000 Fire Panel (all versions with VNC functionality)

Discovery Timeline

2025-05-30 - CVE CVE-2025-46352 published to NVD
2025-05-30 - Last updated in NVD database

Technical Details for CVE-2025-46352

Vulnerability Analysis

This vulnerability falls under CWE-798 (Use of Hard-coded Credentials), a critical security weakness in which authentication credentials are embedded directly into software and cannot be modified. In this case, the CS5000 Fire Panel's VNC server binary contains a static password stored as a plaintext string within the executable itself.

The hard-coded nature of this credential means that every deployed instance of the affected fire panel uses the identical password for VNC access. Once this password becomes known—whether through reverse engineering, information sharing in underground forums, or accidental disclosure—all vulnerable systems become simultaneously exposed. This represents a catastrophic failure mode for devices responsible for critical life-safety functions.

The impact extends beyond simple unauthorized access. An attacker who gains VNC control of a fire panel can potentially disable fire detection capabilities, prevent alarm transmission to monitoring stations, interfere with automated suppression system activation, or place the entire panel in a non-functional state. In environments such as hospitals, schools, or industrial facilities, such interference could have life-threatening consequences.

Root Cause

The fundamental root cause is the design decision to embed a static, unchangeable password within the VNC server binary. This represents a failure to implement proper credential management, where authentication secrets should be configurable, unique per installation, and stored securely. The visibility of the password as a readable string in the binary further exacerbates the issue, making extraction trivial through basic reverse engineering techniques.

Attack Vector

The attack vector is network-based, requiring the attacker to have network connectivity to the VNC service running on the fire panel. The attack sequence involves:

Network reconnaissance to identify CS5000 Fire Panels with exposed VNC services
Extraction of the hard-coded password from the VNC binary (one-time effort applicable to all targets)
Connection to the target panel's VNC service using the static credential
Full remote control of fire panel operations through the VNC interface

The attack requires no authentication bypass, no exploitation of memory corruption, and no special tools beyond a standard VNC client. The network accessibility of VNC services on operational technology (OT) networks, especially those improperly segmented from IT infrastructure, increases the attack surface considerably.

Detection Methods for CVE-2025-46352

Indicators of Compromise

Unexpected VNC connections to CS5000 Fire Panel devices from unauthorized IP addresses
VNC authentication success events from external or non-administrative network segments
Configuration changes to fire panel settings during unusual hours or without corresponding change tickets
Alarm system modifications or suppressions without authorized personnel activity

Detection Strategies

Monitor network traffic for VNC protocol communications (TCP port 5900 and related ports) to fire panel devices
Implement network access control lists to restrict VNC access to authorized management stations only
Deploy intrusion detection rules to alert on VNC connections from non-whitelisted sources
Review fire panel audit logs for unauthorized configuration changes or operational commands

Monitoring Recommendations

Establish baseline normal VNC access patterns and alert on deviations
Integrate fire panel network segments into SIEM monitoring for centralized visibility
Implement real-time alerting for any VNC connection attempts from outside designated administrative VLANs
Conduct periodic network scans to identify any fire panels with VNC services accessible from unintended network segments

How to Mitigate CVE-2025-46352

Immediate Actions Required

Implement strict network segmentation to isolate CS5000 Fire Panels from general network access
Deploy firewall rules to block VNC traffic (TCP 5900+) to fire panels except from explicitly authorized management workstations
Conduct asset inventory to identify all deployed CS5000 Fire Panels in your environment
Contact Consilium Safety for guidance on available firmware updates or mitigation options

Patch Information

Consult the CISA ICSA-25-148-03 Advisory for official guidance and remediation information. Additionally, visit the Consilium Safety Support Resource for vendor-specific updates and technical support regarding this vulnerability.

Workarounds

Disable VNC functionality on the fire panel if remote management is not operationally required
Place fire panel systems behind a VPN concentrator requiring strong authentication before VNC access is possible
Implement jump servers or bastion hosts as the sole authorized pathway for administrative VNC connections
Consider deploying network-level intrusion prevention systems (IPS) to block unauthorized VNC connection attempts

bash

# Example firewall rule to restrict VNC access to fire panels
# Allow VNC only from dedicated management workstation (192.168.10.50)
# Deny all other VNC traffic to fire panel subnet (10.0.100.0/24)

iptables -A FORWARD -s 192.168.10.50 -d 10.0.100.0/24 -p tcp --dport 5900 -j ACCEPT
iptables -A FORWARD -d 10.0.100.0/24 -p tcp --dport 5900 -j DROP