CSL DualCom GPRS CS2300-R alarm signalling boards are secure premises transmitters (SPT) that notify alarm receiving centers (ARC) when an alarm system is tripped. According to researcher Andrew Tierney, CS2300-R boards are vulnerable to signal spoofing and tampering due to the vendor's use of a weak communications protocol and proprietary encryption scheme. The vendor has generally disputed the researcher's findings with the following statement:

- As with all our products, this product has been certified as compliant to the required European standard EN-50136
- Our internal review of the report concluded there is no threat to these systems

• the encryption algorithm is a polyalphabetic substitution cipher and subject to decryption via common cryptanalytic techniques
• encryption keys (mapping tables for substitution) are hardcoded in the firmware and have not changed from v1.25 to v3.53
• effective key length is very short
• messages do not contain sequence numbers
• messages do not make use of checksums or hashes
• messages do not contain message authentication codes (MAC)
• key material cannot be readily updated
• sensitive SPT identification information can be obtained by capturing and analyzing single messages

A remote, unauthenticated attacker may be able to decrypt communications and spoof messages between SPTs and ARCs, resulting in denial of service, false alarms, suppressed alarms, and a general inability to trust communications bilaterally.

The CERT/CC is currently unaware of a practical solution to this problem. According to the researcher, hardware limitations may render a cryptographic solution difficult while maintaining current functionality. Note that the vendor has generally disputed the researcher's findings with the following statement:

- As with all our products, this product has been certified as compliant to the required European standard EN-50136
- Our internal review of the report concluded there is no threat to these systems