PT-2019-3607 · Zingbox · Zingbox Inspector

CVE-2019-15019 · Publicado 2019-10-01 · Atualizado 2023-02-15

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zingbox Inspector versions 1.294 and earlier

Description The issue exists due to insufficient input validation in the network traffic handler. This could allow a remote attacker to intercept and modify a software update package. An attacker may supply an invalid software update image to the Zingbox Inspector.

Recommendations For versions 1.294 and earlier, update to a version later than 1.294 to resolve the issue. As a temporary workaround, consider restricting access to the software update mechanism until a patch is available. Avoid using the vulnerable network traffic handler until the issue is resolved.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2019-03821

CVE-2019-15019

Produtos afetados

Zingbox Inspector

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-15019 · Nota de Segurança
• https://bdu.fstec.ru/vul/2019-03821 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-15019 · Aviso do Fabricante
• https://security.paloaltonetworks.com/CVE-2019-15019 · Nota
• https://t.me/cvenotify/44324 · Publicação no Telegram
• https://securityadvisories.paloaltonetworks.com/Home/Detail/182 · Nota