CVE-2019-12254 (GCVE-0-2019-12254)
Vulnerability from cvelistv5 – Published: 2022-05-06 17:30 – Updated: 2024-09-16 20:22
VLAI?
Title
TECSON/GOK: Improper Authentication and Access Control on multiple devices
Summary
In multiple Tecson Tankspion and GOKs SmartBox 4 products the affected application doesn't properly restrict access to an endpoint that is responsible for saving settings, to a unauthenticated user with limited access rights. Based on the lack of adequately implemented access-control rules, by accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to change the application settings without authenticating at all, which violates originally laid ACL rules.
Severity ?
9.8 (Critical)
CWE
- CWE-287 - Improper Authentication
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| TECSON | e-litro net |
Affected:
unspecified , < V6.32
(custom)
|
||||||||||||||||||||||
|
||||||||||||||||||||||||
Date Public ?
2019-04-06 00:00
Credits
Maxim Rupp (rupp.it) reported this vulnerability to CERT@VDE.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T23:17:39.190Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://cert.vde.com/en/advisories/VDE-2019-012/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "e-litro net",
"vendor": "TECSON",
"versions": [
{
"lessThan": "V6.32",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "LX-Net",
"vendor": "TECSON",
"versions": [
{
"lessThan": "V6.32",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "LX-Q-Net",
"vendor": "TECSON",
"versions": [
{
"lessThan": "V6.32",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "SmartBox 4 LAN",
"vendor": "GOK",
"versions": [
{
"lessThan": "V6.3",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "SmartBox 4 LAN PRO",
"vendor": "GOK",
"versions": [
{
"lessThan": "V6.3",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Maxim Rupp (rupp.it) reported this vulnerability to CERT@VDE."
}
],
"datePublic": "2019-04-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "In multiple Tecson Tankspion and GOKs SmartBox 4 products the affected application doesn\u0027t properly restrict access to an endpoint that is responsible for saving settings, to a unauthenticated user with limited access rights. Based on the lack of adequately implemented access-control rules, by accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to change the application settings without authenticating at all, which violates originally laid ACL rules."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-05-06T17:30:11.000Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://cert.vde.com/en/advisories/VDE-2019-012/"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to firmware version \u003e 6.32"
}
],
"source": {
"advisory": "VDE-2019-012",
"discovery": "EXTERNAL"
},
"title": "TECSON/GOK: Improper Authentication and Access Control on multiple devices",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "info@cert.vde.com",
"DATE_PUBLIC": "2019-04-06T10:00:00.000Z",
"ID": "CVE-2019-12254",
"STATE": "PUBLIC",
"TITLE": "TECSON/GOK: Improper Authentication and Access Control on multiple devices"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "e-litro net",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "V6.32"
}
]
}
},
{
"product_name": "LX-Net",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "V6.32"
}
]
}
},
{
"product_name": "LX-Q-Net",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "V6.32"
}
]
}
}
]
},
"vendor_name": "TECSON"
},
{
"product": {
"product_data": [
{
"product_name": "SmartBox 4 LAN",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "V6.3"
}
]
}
},
{
"product_name": "SmartBox 4 LAN PRO",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "V6.3"
}
]
}
}
]
},
"vendor_name": "GOK"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Maxim Rupp (rupp.it) reported this vulnerability to CERT@VDE."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In multiple Tecson Tankspion and GOKs SmartBox 4 products the affected application doesn\u0027t properly restrict access to an endpoint that is responsible for saving settings, to a unauthenticated user with limited access rights. Based on the lack of adequately implemented access-control rules, by accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to change the application settings without authenticating at all, which violates originally laid ACL rules."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-287 Improper Authentication"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://cert.vde.com/en/advisories/VDE-2019-012/",
"refsource": "CONFIRM",
"url": "https://cert.vde.com/en/advisories/VDE-2019-012/"
}
]
},
"solution": [
{
"lang": "en",
"value": "Upgrade to firmware version \u003e 6.32"
}
],
"source": {
"advisory": "VDE-2019-012",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2019-12254",
"datePublished": "2022-05-06T17:30:12.071Z",
"dateReserved": "2019-05-21T00:00:00.000Z",
"dateUpdated": "2024-09-16T20:22:12.620Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2019-12254\",\"sourceIdentifier\":\"info@cert.vde.com\",\"published\":\"2022-05-06T18:15:08.397\",\"lastModified\":\"2024-11-21T04:22:29.477\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In multiple Tecson Tankspion and GOKs SmartBox 4 products the affected application doesn\u0027t properly restrict access to an endpoint that is responsible for saving settings, to a unauthenticated user with limited access rights. Based on the lack of adequately implemented access-control rules, by accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to change the application settings without authenticating at all, which violates originally laid ACL rules.\"},{\"lang\":\"es\",\"value\":\"En varios productos Tecson Tankspion y GOKs SmartBox 4, la aplicaci\u00f3n afectada no restringe apropiadamente el acceso a un endpoint que es responsable de guardar la configuraci\u00f3n, a un usuario no autenticado con derechos de acceso limitados. Bas\u00e1ndose en la falta de reglas de control de acceso adecuadamente implementadas, al acceder a un localizador uniforme de recursos (URL) espec\u00edfico en el servidor web, un usuario malicioso es capaz de cambiar la configuraci\u00f3n de la aplicaci\u00f3n sin autenticarse en absoluto, lo que viola las reglas ACL originalmente establecidas\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"info@cert.vde.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:C/I:C/A:C\",\"baseScore\":10.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"info@cert.vde.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-287\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:gok:smartbox_4_lan_firmware:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4C9385EB-5444-400B-8E50-D2BE1813EFD1\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:gok:smartbox_4_lan:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F9081DF-4A88-4693-9F02-0554C3DBE67E\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:gok:smartbox_4_lan_pro_firmware:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E666749C-0320-493E-B4FB-25E52D376F6F\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:gok:smartbox_4_lan_pro:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A7BBB65A-A593-43EE-A781-56D837C5C904\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:tecson:lx-q-net_firmware:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BC2D7550-F679-40C8-84FE-D26450F0006F\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:tecson:lx-q-net:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CA2F641C-4883-460E-8B49-DE793C495961\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:tecson:lx-net_firmware:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4749C693-6D51-4067-9B52-9A03811D4F35\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:tecson:lx-net:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9692F473-3325-4EE5-9EA3-CD8975B260AC\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:tecson:e-litro_net_firmware:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"355A7726-E136-4AB5-A09C-862D42A1B2E3\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:tecson:e-litro_net:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AFFDE7D6-E2EF-40C3-B44A-7516A3F13703\"}]}]}],\"references\":[{\"url\":\"https://cert.vde.com/en/advisories/VDE-2019-012/\",\"source\":\"info@cert.vde.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://cert.vde.com/en/advisories/VDE-2019-012/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…