PT-2019-12260 · Auo · Auo Solar Data Recorder

Publicado 2019-06-03 · Atualizado 2020-08-24 · CVE-2019-11367

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AUO Solar Data Recorder versions prior to 1.3.0

Description An issue was discovered where the web portal of the affected software uses HTTP Basic Authentication and provides the account and password in the WWW-Authenticate attribute, allowing anyone to login successfully using these credentials.

Recommendations For versions prior to 1.3.0, update to version 1.3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the web portal to minimize the risk of exploitation.

Exploit

Correção

Insufficiently Protected Credentials

Missing Encryption of Sensitive Data

Enumeração de Fraquezas

CWE-522

CWE-311

Identificadores relacionados

CVE-2019-11367

Produtos afetados

Auo Solar Data Recorder

Referências · 5

• 🔥 https://drive.google.com/file/d/1H1L5s14Omnx1eJAdRlRninnqUKLJ_xDA/view · Exploit
• 🔥 http://packetstormsecurity.com/files/153151/AUO-Solar-Data-Recorder-Incorrect-Access-Control.html · Exploit
• 🔥 https://github.com/nepenthe0320/cve_poc/blob/master/CVE-2019-11367 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-11367 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-11367 · Aviso do Fabricante