FKIE_CVE-2019-12254
Vulnerability from fkie_nvd - Published: 2022-05-06 18:15 - Updated: 2024-11-21 04:22
Severity ?
Summary
In multiple Tecson Tankspion and GOKs SmartBox 4 products the affected application doesn't properly restrict access to an endpoint that is responsible for saving settings, to a unauthenticated user with limited access rights. Based on the lack of adequately implemented access-control rules, by accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to change the application settings without authenticating at all, which violates originally laid ACL rules.
References
| URL | Tags | ||
|---|---|---|---|
| info@cert.vde.com | https://cert.vde.com/en/advisories/VDE-2019-012/ | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://cert.vde.com/en/advisories/VDE-2019-012/ | Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| gok | smartbox_4_lan_firmware | * | |
| gok | smartbox_4_lan | - | |
| gok | smartbox_4_lan_pro_firmware | * | |
| gok | smartbox_4_lan_pro | - | |
| tecson | lx-q-net_firmware | * | |
| tecson | lx-q-net | - | |
| tecson | lx-net_firmware | * | |
| tecson | lx-net | - | |
| tecson | e-litro_net_firmware | * | |
| tecson | e-litro_net | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:gok:smartbox_4_lan_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4C9385EB-5444-400B-8E50-D2BE1813EFD1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:gok:smartbox_4_lan:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7F9081DF-4A88-4693-9F02-0554C3DBE67E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:gok:smartbox_4_lan_pro_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E666749C-0320-493E-B4FB-25E52D376F6F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:gok:smartbox_4_lan_pro:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A7BBB65A-A593-43EE-A781-56D837C5C904",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tecson:lx-q-net_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BC2D7550-F679-40C8-84FE-D26450F0006F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tecson:lx-q-net:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CA2F641C-4883-460E-8B49-DE793C495961",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tecson:lx-net_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4749C693-6D51-4067-9B52-9A03811D4F35",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tecson:lx-net:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9692F473-3325-4EE5-9EA3-CD8975B260AC",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tecson:e-litro_net_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "355A7726-E136-4AB5-A09C-862D42A1B2E3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tecson:e-litro_net:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AFFDE7D6-E2EF-40C3-B44A-7516A3F13703",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In multiple Tecson Tankspion and GOKs SmartBox 4 products the affected application doesn\u0027t properly restrict access to an endpoint that is responsible for saving settings, to a unauthenticated user with limited access rights. Based on the lack of adequately implemented access-control rules, by accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to change the application settings without authenticating at all, which violates originally laid ACL rules."
},
{
"lang": "es",
"value": "En varios productos Tecson Tankspion y GOKs SmartBox 4, la aplicaci\u00f3n afectada no restringe apropiadamente el acceso a un endpoint que es responsable de guardar la configuraci\u00f3n, a un usuario no autenticado con derechos de acceso limitados. Bas\u00e1ndose en la falta de reglas de control de acceso adecuadamente implementadas, al acceder a un localizador uniforme de recursos (URL) espec\u00edfico en el servidor web, un usuario malicioso es capaz de cambiar la configuraci\u00f3n de la aplicaci\u00f3n sin autenticarse en absoluto, lo que viola las reglas ACL originalmente establecidas"
}
],
"id": "CVE-2019-12254",
"lastModified": "2024-11-21T04:22:29.477",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "info@cert.vde.com",
"type": "Secondary"
}
]
},
"published": "2022-05-06T18:15:08.397",
"references": [
{
"source": "info@cert.vde.com",
"tags": [
"Third Party Advisory"
],
"url": "https://cert.vde.com/en/advisories/VDE-2019-012/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://cert.vde.com/en/advisories/VDE-2019-012/"
}
],
"sourceIdentifier": "info@cert.vde.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-287"
}
],
"source": "info@cert.vde.com",
"type": "Secondary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…