PT-2019-12936 · Enttec · Enttec E-Streamer Mk2+3
Publicado
2019-06-07
·
Atualizado
2020-08-24
·
CVE-2019-12775
CVSS v2.0
9.0
Alta
| Vetor | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
ENTTEC Datagate MK2 version 70044 update 05032019-482
ENTTEC Storm 24 version 70044 update 05032019-482
ENTTEC Pixelator version 70044 update 05032019-482
ENTTEC E-Streamer MK2 version 70044 update 05032019-482
Description
The issue allows high-privileged root access by www-data via sudo without requiring appropriate access control. The user account controlling the web application service has full access to run any system commands with elevated privilege, without the need for password authentication. This could allow a threat actor to create or run high-privileged binaries or executables within the device's operating system if vulnerabilities are identified and exploited within the web application.
Recommendations
For ENTTEC Datagate MK2 version 70044 update 05032019-482, consider restricting the
www-data user's access to sudo until a patch is available.
For ENTTEC Storm 24 version 70044 update 05032019-482, consider restricting the www-data user's access to sudo until a patch is available.
For ENTTEC Pixelator version 70044 update 05032019-482, consider restricting the www-data user's access to sudo until a patch is available.
For ENTTEC E-Streamer MK2 version 70044 update 05032019-482, consider restricting the www-data user's access to sudo until a patch is available.
As a temporary workaround, consider disabling the web application service until a patch is available to minimize the risk of exploitation.Exploit
Correção
Improper Privilege Management
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Enttec Datagate Mk2
Enttec E-Streamer Mk2
Enttec Pixelator
Enttec Storm 24