OVER 49K MISCONFIGURED BUILDING MANAGEMENT SYSTEMS EXPOSED ONLINE

Summary from the TLDR InfoSec newsletter

Researchers from Modat discovered 49K exposed Access Management Systems that were not correctly configured for secure authentication. Anyone could view unencrypted employee data such as names, email addresses, phone numbers, biometrics, photos, work schedules, and access logs. In some cases, Modat could even edit employee records, add fake employees, change access credentials, restrict access to legitimate employees, and grant access to malicious actors.