Vulnerability-Lookup

CNVD-2019-36672

Vulnerability from cnvd - Published: 2019-10-22

Title

Palo Alto Networks Zingbox Inspector信任管理问题漏洞

Description

Palo Alto Networks Zingbox Inspector是美国Palo Alto Networks公司的一款Zingbox IoT Command Center物联网控制中心解决方案中的本地部署设备。 Palo Alto Networks Zingbox Inspector 1.294及之前版本中存在信任管理问题漏洞。攻击者可利用该漏洞未授权访问系统。

Severity

高

Patch Name

Palo Alto Networks Zingbox Inspector信任管理问题漏洞（CNVD-2019-36672）的补丁

Patch Description

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://securityadvisories.paloaltonetworks.com/Home/Detail/170

Reference

https://nvd.nist.gov/vuln/detail/CVE-2019-15015

Impacted products

Name
Palo Alto Networks Zingbox Inspector <=1.294

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2019-15015",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2019-15015"
    }
  },
  "description": "Palo Alto Networks Zingbox Inspector\u662f\u7f8e\u56fdPalo Alto Networks\u516c\u53f8\u7684\u4e00\u6b3eZingbox IoT Command Center\u7269\u8054\u7f51\u63a7\u5236\u4e2d\u5fc3\u89e3\u51b3\u65b9\u6848\u4e2d\u7684\u672c\u5730\u90e8\u7f72\u8bbe\u5907\u3002\n\nPalo Alto Networks Zingbox Inspector 1.294\u53ca\u4e4b\u524d\u7248\u672c\u4e2d\u5b58\u5728\u4fe1\u4efb\u7ba1\u7406\u95ee\u9898\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u672a\u6388\u6743\u8bbf\u95ee\u7cfb\u7edf\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://securityadvisories.paloaltonetworks.com/Home/Detail/170",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2019-36672",
  "openTime": "2019-10-22",
  "patchDescription": "Palo Alto Networks Zingbox Inspector\u662f\u7f8e\u56fdPalo Alto Networks\u516c\u53f8\u7684\u4e00\u6b3eZingbox IoT Command Center\u7269\u8054\u7f51\u63a7\u5236\u4e2d\u5fc3\u89e3\u51b3\u65b9\u6848\u4e2d\u7684\u672c\u5730\u90e8\u7f72\u8bbe\u5907\u3002\r\nPalo Alto Networks Zingbox Inspector 1.294\u53ca\u4e4b\u524d\u7248\u672c\u4e2d\u5b58\u5728\u4fe1\u4efb\u7ba1\u7406\u95ee\u9898\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u672a\u6388\u6743\u8bbf\u95ee\u7cfb\u7edf\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Palo Alto Networks Zingbox Inspector\u4fe1\u4efb\u7ba1\u7406\u95ee\u9898\u6f0f\u6d1e\uff08CNVD-2019-36672\uff09\u7684\u8865\u4e01",
  "products": {
    "product": "Palo Alto Networks Zingbox Inspector \u003c=1.294"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2019-15015",
  "serverity": "\u9ad8",
  "submitTime": "2019-10-21",
  "title": "Palo Alto Networks Zingbox Inspector\u4fe1\u4efb\u7ba1\u7406\u95ee\u9898\u6f0f\u6d1e"
}

CVE-2019-15015 (GCVE-0-2019-15015)

Vulnerability from cvelistv5 – Published: 2019-10-09 20:20 – Updated: 2024-08-05 00:34

Summary

In the Zingbox Inspector, versions 1.294 and earlier, hardcoded credentials for root and inspector user accounts are present in the system software, which can result in unauthorized users gaining access to the system.

Severity

No CVSS data available.

CWE

Use of Hard-coded Credentials

Assigner

palo_alto

References

1 reference

URL	Tags
https://security.paloaltonetworks.com/CVE-2019-15015	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
n/a	Palo Alto Networks Zingbox Inspector	Affected: Zingbox Inspector, versions 1.294 and earlier.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T00:34:52.975Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://security.paloaltonetworks.com/CVE-2019-15015"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Palo Alto Networks Zingbox Inspector",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Zingbox Inspector, versions 1.294 and earlier."
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Zingbox Inspector, versions 1.294 and earlier, hardcoded credentials for root and inspector user accounts are present in the system software, which can result in unauthorized users gaining access to the system."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Use of Hard-coded Credentials",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-02-17T16:03:47.000Z",
        "orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
        "shortName": "palo_alto"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://security.paloaltonetworks.com/CVE-2019-15015"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@paloaltonetworks.com",
          "ID": "CVE-2019-15015",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Palo Alto Networks Zingbox Inspector",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Zingbox Inspector, versions 1.294 and earlier."
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In the Zingbox Inspector, versions 1.294 and earlier, hardcoded credentials for root and inspector user accounts are present in the system software, which can result in unauthorized users gaining access to the system."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Use of Hard-coded Credentials"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://security.paloaltonetworks.com/CVE-2019-15015",
              "refsource": "MISC",
              "url": "https://security.paloaltonetworks.com/CVE-2019-15015"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
    "assignerShortName": "palo_alto",
    "cveId": "CVE-2019-15015",
    "datePublished": "2019-10-09T20:20:28.000Z",
    "dateReserved": "2019-08-13T00:00:00.000Z",
    "dateUpdated": "2024-08-05T00:34:52.975Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2019-36672

CVE-2019-15015 (GCVE-0-2019-15015)

Tags

Sightings

Nomenclature