Ineo-Sense ACS Padlock II - Prototype Teardown
11 Feb 2025
The Ineo-Sense ACS Padlock 2 prototype is now in hand. In this post I'll go into my findings and planned followup regarding the unit.
If you're using a Quantum, Dell, or ADIC Scalar product you should check to see if the password of the GUI's 'service' account is static. If it is then there is a pretty trivial way to get into the system using the vendor's maintenance account. The one system I have access to, an i2000, has a login of service:10101100.
If you're using a Quantum, Dell, or ADIC Scalar product you need to make sure the 'service port' isn't remotely accessible. If it is then there is a pretty trivial way to get into the system as 'root'. The port is explicitly listed in the manual as not for "normal" use.
tl;dr If you aren't plugging in stuff you shouldn't (per manual) then the risk isn't that bad.