PT-2019-12833 · Inateck · Inateck Wp1001

Publicado 2019-06-07 · Atualizado 2020-08-24 · CVE-2019-12505

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Inateck WP1001 version 1.3C

Description The issue allows for keystroke injection attacks due to unencrypted and unauthenticated data communication. This enables an attacker to send arbitrary keystrokes to a victim's computer system, potentially installing malware on an unattended target system. As a result, an attacker can remotely take control of the victim's computer that is operated with an affected receiver of this device.

Recommendations For Inateck WP1001 version 1.3C, consider disabling the device until a patch or secure alternative is available to prevent keystroke injection attacks. Restrict access to sensitive systems and data when using the affected device to minimize the risk of exploitation.

Correção

Missing Authentication

Cleartext Transmission of Sensitive Information

Enumeração de Fraquezas

CWE-306

CWE-319

Identificadores relacionados

CVE-2019-12505

Produtos afetados

Inateck Wp1001

Referências · 6

• http://seclists.org/fulldisclosure/2019/Jun/4 · Nota
• https://osv.dev/vulnerability/CVE-2019-12505 · Aviso do Fabricante
• http://packetstormsecurity.com/files/153184/Inateck-2.4-GHz-Wireless-Presenter-WP1001-Keystroke-Injection.html · Nota
• https://syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-007.txt · Nota
• https://seclists.org/bugtraq/2019/Jun/2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-12505 · Nota de Segurança