PT-2019-5723 · Advantech · Advantech Spectre Rt Ert351

Publicado 2019-04-25 · Atualizado 2021-03-23 · CVE-2019-18231

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Advantech Spectre RT ERT351 versions 5.1.3 and prior

Description The issue is related to the transmission of logins and passwords in clear text form, which may allow an attacker to intercept the request. This is due to the use of the HTTP protocol by default, which implements basic HTTP authorization. Exploitation of this issue may allow a remote attacker to intercept administrator credentials and other confidential information transmitted during administration.

Recommendations For versions 5.1.3 and prior, consider disabling the use of HTTP protocol for login and password transmission until a secure protocol is implemented. Restrict access to the administration interface to minimize the risk of exploitation. Avoid using the default basic HTTP authorization method until the issue is resolved.

Correção

Cleartext Transmission of Sensitive Information

Enumeração de Fraquezas

CWE-319

Identificadores relacionados

BDU:2021-00846

CVE-2019-18231

Produtos afetados

Advantech Spectre Rt Ert351

Referências · 7

• https://ep.advantech-bb.cz/support/router-models/download/511/sa-2021-01-fw-5.1.3-and-older-en.pdf · Aviso do Fabricante
• https://us-cert.cisa.gov/ics/advisories/icsa-21-054-03 · Nota
• https://t.me/cibsecurity/25055 · Publicação no Telegram
• https://t.me/cvenotify/11484 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2019-18231 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2021-00846 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2019-18231 · Nota de Segurança