PT-2019-12354 · Anviz · Anviz Global M3 Outdoor Rfid Access Control

Publicado 2019-05-23 · Atualizado 2020-08-24 · CVE-2019-11523

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Anviz Global M3 Outdoor RFID Access Control (affected versions not specified)

Description The issue allows attackers to execute any command on the device without authentication or encryption. This enables full interaction with the device, including sending commands like "open door", downloading the users list which contains RFID codes and passcodes in cleartext, or updating/creating users. The attack can be performed both on a local network and over the internet if the device is exposed to a public IP address.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Encryption of Sensitive Data

Missing Authentication

Enumeração de Fraquezas

CWE-311

CWE-306

Identificadores relacionados

CVE-2019-11523

Produtos afetados

Anviz Global M3 Outdoor Rfid Access Control

Referências · 3

• 🔥 https://github.com/wizlab-it/anviz-m3-rfid-cve-2019-11523-poc · Exploit
• https://t.me/defcon_news/14516 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2019-11523 · Nota de Segurança