CVE-2017-16241 is a missing-authentication vulnerability (CWE-306) in AMAG Technology's Symmetry Door Edge network door controllers, physical hardware that directly drives a building's electric door locks and card readers: an attacker who can reach the device's Serial-over-TCP/IP interface can send unauthenticated commands to remotely lock or unlock the door, or inject a fraudulent access-card value into the controller's own database, and NVD has published its own Primary CVSS v3.0 score of 7.5 (high) for the flaw.
Vulnerability summary
7.5
High
2.0%
EPSS score (FIRST)
No
CISA KEV catalog
2017-12-10
Published
Vulnerability ID: CVE-2017-16241 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| AMAG Technology Symmetry Door Edge networked door controller (physical access-control hardware that drives electric door locks and card readers directly, used standalone or as part of a larger Symmetry access-control system) | — | EN-1DBC (Boot App 23611 v03.60 and STD App 23603 v03.60) and EN-2DBC (Boot App 24451 v01.00 and STD App 2461 v01.00), per NVD; Sophos/Secureworks reported all firmware versions available at disclosure time (2017-12) as vulnerable |
What does this mean for affected devices?
CVE-2017-16241 (CWE-306, missing authentication for a critical function) affects AMAG Technology's Symmetry Door Edge network door controllers — physical access-control hardware, not just management software, that sits at the door itself and drives the electric lock and card reader directly. NVD's description states: "Incorrect access control in AMAG Symmetry Door Edge Network Controllers (EN-1DBC Boot App 23611 03.60 and STD App 23603 03.60; EN-2DBC Boot App 24451 01.00 and STD App 2461 01.00) enables remote attackers to execute door controller commands (e.g., lock, unlock, add ID card value) by sending unauthenticated requests to the affected devices via Serial over TCP/IP, as demonstrated by a Ud command" (NVD).
NVD lists its own Primary CVSS v3.0 base score of 7.5 (high), vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N — network-reachable, no authentication or user interaction needed, scored for integrity impact on the door-control state (NVD).
The flaw was independently researched and disclosed by Mike Kelly and John Mocuta of Secureworks (now part of Sophos) as Security Advisory 2017-001, which rated the same issue at CVSS v3 9.3 using its own scoring assumptions, and described the impact as: "Incorrect access control in AMAG Technology Symmetry Door Edge Network Controllers enables remote attackers to execute door controller commands (e.g., lock, unlock, add ID card value) by sending unauthenticated requests" (Sophos/Secureworks Advisory 2017-001). The same underlying flaw was also disclosed independently by another researcher at the HushCon Seattle 2017 security conference around the same time, and NVD's own reference list links to a public proof-of-concept exploit repository, indicating working exploit code has circulated publicly since shortly after disclosure (NVD).
In practice, successful exploitation lets an attacker remotely unlock a protected door or write a new, attacker-chosen access-card value directly into the controller's local database — creating a durable physical-access backdoor that would keep working even if the attacker's network access were later cut off, until the card database is audited and cleaned.
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.01997 (80.84th percentile) as of 2026-11-07 — a high-severity, publicly exploitable physical-access-control flaw with no confirmed in-the-wild exploitation reported (CISA KEV, FIRST EPSS).
Any AMAG Symmetry EN-1DBC or EN-2DBC door controller should not be reachable from an untrusted network; its Serial-over-TCP/IP command interface should sit on an isolated, access-controlled building-management network segment, and its access-card database should be audited for unexpected entries if unauthorized network access is suspected.
Evidence
- Incorrect access control in AMAG Symmetry Door Edge Network Controllers (EN-1DBC and EN-2DBC, specific boot/STD app firmware versions) enables remote attackers to execute door-controller commands such as lock, unlock and add ID card value, by sending unauthenticated requests via Serial over TCP/IP. — NVD
- NVD Primary CVSS v3.0 base score 7.5 (high), vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N; CWE-306. — NVD
- Disclosed by Mike Kelly and John Mocuta of Secureworks as Security Advisory 2017-001, which independently rated the flaw at CVSS v3 9.3 and described the same lock/unlock/add-card impact. — Sophos/Secureworks Advisory 2017-001
- NVD's reference list links a public proof-of-concept exploit repository for this CVE. — NVD
- Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.01997 (80.84th percentile) as of 2026-11-07. — FIRST EPSS
Questions about this page?
Related advisories
Sources
Frequently asked questions
What can an attacker do by exploiting CVE-2017-16241?
An attacker who can reach an AMAG Symmetry Door Edge network door controller's Serial-over-TCP/IP interface can send unauthenticated commands to remotely lock or unlock the protected door, or add a new ID card value directly into the controller's own database — without needing any credentials (per NVD; per Sophos/Secureworks Advisory 2017-001).
Which specific devices does this affect?
NVD names the EN-1DBC (Boot App 23611 v03.60, STD App 23603 v03.60) and EN-2DBC (Boot App 24451 v01.00, STD App 2461 v01.00) AMAG Symmetry Door Edge network door controllers as affected (per NVD).
Does NVD's own severity score match the researchers' assessment?
Not exactly. NVD's own Primary CVSS v3.0 score is 7.5 (high), while Secureworks (now Sophos), the team that disclosed the flaw, independently rated it higher at 9.3 under its own scoring assumptions — both agree the issue allows unauthenticated door-control commands (per NVD; per Sophos/Secureworks Advisory 2017-001).