fkie_cve-2019-9484
Vulnerability from fkie_nvd
Published
2019-03-01 07:29
Modified
2024-11-21 04:51
Severity ?
Summary
The Glen Dimplex Deutschland GmbH implementation of the Carel pCOWeb configuration tool allows remote attackers to obtain access via an HTTP session on port 10000, as demonstrated by reading the modem password (which is 1234), or reconfiguring "party mode" or "vacation mode."
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| carel | pcoweb_card_firmware | - | |
| carel | pcoweb_card | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:carel:pcoweb_card_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C8319F37-D9AD-4660-831B-656E52C7DAFC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:carel:pcoweb_card:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DE87B839-78E7-4789-9B5A-7EAB4834337B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Glen Dimplex Deutschland GmbH implementation of the Carel pCOWeb configuration tool allows remote attackers to obtain access via an HTTP session on port 10000, as demonstrated by reading the modem password (which is 1234), or reconfiguring \"party mode\" or \"vacation mode.\""
},
{
"lang": "es",
"value": "La implementaci\u00f3n de Glen Dimplex Deutschland GmbH de la herramienta de configuraci\u00f3n Carel pCOWeb permite que los atacantes remotos obtengan acceso mediante una sesi\u00f3n HTTP en el puerto 10000, tal y como queda demostrado con la lectura de la contrase\u00f1a del m\u00f3dem (1234) o con la reconfiguraci\u00f3n de los modos \"party\" o \"vacation\"."
}
],
"id": "CVE-2019-9484",
"lastModified": "2024-11-21T04:51:42.533",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-03-01T07:29:00.217",
"references": [
{
"source": "cve@mitre.org",
"url": "https://medium.com/%40SergiuSechel/insecure-permissions-in-glen-dimplex-deutschland-gmbh-implementation-of-carel-pcoweb-configuration-ca3896f24835"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://medium.com/%40SergiuSechel/insecure-permissions-in-glen-dimplex-deutschland-gmbh-implementation-of-carel-pcoweb-configuration-ca3896f24835"
}
],
"sourceIdentifier": "cve@mitre.org",
"vendorComments": [
{
"comment": "Glen Dimplex Deutschland GmbH does not deliver the Carel pCOweb card with an open port 10000 or 10001. \nThe shown password \u20181234\u2019 on the webpage is not being used in any current application. \nIt was being used in former times together with a connection via modem, this is not realized anymore.\nMore details to the current application: www.dimplex.de/wiki.",
"lastModified": "2020-05-29T13:03:44.587",
"organization": "Glen Dimplex Deutschland GmbH"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-306"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…