PT-2019-12241 · Topcon Positioning · Net-G5 Gnss Receiver

Published 2019-09-20 · Updated 2020-08-24 · CVE-2019-11326

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Topcon Positioning Net-G5 GNSS Receiver firmware 5.2.2

Description An issue was discovered in the web interface of the Topcon Positioning Net-G5 GNSS Receiver, where a guest login is allowed by default. Once logged in as a guest, an attacker can browse a specific URL to read the password of the administrative user, potentially gaining administrative privileges. This issue affects the default configuration of the device.

Recommendations For firmware 5.2.2, consider disabling the guest login feature to prevent unauthorized access until a patch is available. Restrict access to the administrative user interface to minimize the risk of exploitation. Avoid using the default configuration and ensure that the device is properly secured to prevent unauthorized logins.

Fix

Weakness Enumeration

CWE-425

Related Identifiers

CVE-2019-11326

Affected Products

Net-G5 Gnss Receiver

References · 3

• https://osv.dev/vulnerability/CVE-2019-11326 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11326 · Security Note
• https://mezdanak.de/2019/06/21/iot-full-disclosure-topcon-positioning-net-g5-receiver · Note