PT-2019-12241 · Topcon Positioning · Net-G5 Gnss Receiver

Publicado 2019-09-20 · Atualizado 2020-08-24 · CVE-2019-11326

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Topcon Positioning Net-G5 GNSS Receiver firmware 5.2.2

Description An issue was discovered in the web interface of the Topcon Positioning Net-G5 GNSS Receiver, where a guest login is allowed by default. Once logged in as a guest, an attacker can browse a specific URL to read the password of the administrative user, potentially gaining administrative privileges. This issue affects the default configuration of the device.

Recommendations For firmware 5.2.2, consider disabling the guest login feature to prevent unauthorized access until a patch is available. Restrict access to the administrative user interface to minimize the risk of exploitation. Avoid using the default configuration and ensure that the device is properly secured to prevent unauthorized logins.

Correção

Enumeração de Fraquezas

CWE-425

Identificadores relacionados

CVE-2019-11326

Produtos afetados

Net-G5 Gnss Receiver

Referências · 3

• https://osv.dev/vulnerability/CVE-2019-11326 · Aviso do Fabricante
• https://mezdanak.de/2019/06/21/iot-full-disclosure-topcon-positioning-net-g5-receiver · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-11326 · Nota de Segurança