PT-2019-17411 · Capsule Technologies · Smartlinx Neuron 2

Publicado 2019-04-11 · Atualizado 2022-06-13 · CVE-2019-5024

Positive Technologies (AI Summary)

CVSS v3.1

7.6

Alta

Vetor base

AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Capsule Technologies SmartLinx Neuron 2 versions 9.0.3 or lower

Description A restricted environment escape issue exists in the "kiosk mode" function, allowing an attacker to escape the restricted environment with a specific series of keyboard inputs. This results in full administrator access to the underlying operating system. An attacker can connect to the device via USB port with a keyboard or other HID device to trigger this issue.

Recommendations For versions 9.0.3 or lower, consider restricting access to the USB port to minimize the risk of exploitation, and avoid using the "kiosk mode" function until a fix is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

Protection Mechanism Failure

Enumeração de Fraquezas

CWE-693

Identificadores relacionados

CVE-2019-5024

Produtos afetados

Smartlinx Neuron 2

Referências · 4

• https://talosintelligence.com/vulnerability_reports/TALOS-2019-0785 · Nota
• https://t.me/cvenotify/29353 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2019-5024 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-5024 · Nota de Segurança