PT-2019-12262 · Carel · Pcoweb

Publicado 2019-06-03 · Atualizado 2020-08-24 · CVE-2019-11369

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Carel pCOWeb versions prior to B1.2.4

Description An issue in Carel pCOWeb allows the device to store cleartext passwords in the /config/pw changeusers.html file, potentially enabling someone with access to the device to read sensitive information.

Recommendations For versions prior to B1.2.4, update to version B1.2.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the /config/pw changeusers.html file to minimize the risk of exploitation.

Exploit

Correção

Insufficiently Protected Credentials

Enumeração de Fraquezas

CWE-522

Identificadores relacionados

CVE-2019-11369

Produtos afetados

Pcoweb

Referências · 6

• 🔥 https://github.com/nepenthe0320/cve_poc/blob/master/CVE-2019-11369 · Exploit
• 🔥 https://drive.google.com/open?id=12Sq6oaxe1mC1y71Emo1YladjDjwTdNfb · Exploit
• 🔥 https://exploit-db.com/exploits/46898 · Exploit
• https://osv.dev/vulnerability/CVE-2019-11369 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-11369 · Nota de Segurança
• http://seclists.org/fulldisclosure/2019/Oct/45 · Nota