PT-2019-12260 · Auo · Auo Solar Data Recorder

Published 2019-06-03 · Updated 2020-08-24 · CVE-2019-11367

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AUO Solar Data Recorder versions prior to 1.3.0

Description An issue was discovered where the web portal of the affected software uses HTTP Basic Authentication and provides the account and password in the WWW-Authenticate attribute, allowing anyone to login successfully using these credentials.

Recommendations For versions prior to 1.3.0, update to version 1.3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the web portal to minimize the risk of exploitation.

Exploit

Fix

Insufficiently Protected Credentials

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-522

CWE-311

Related Identifiers

CVE-2019-11367

Affected Products

Auo Solar Data Recorder

References · 5

• 🔥 https://drive.google.com/file/d/1H1L5s14Omnx1eJAdRlRninnqUKLJ_xDA/view · Exploit
• 🔥 http://packetstormsecurity.com/files/153151/AUO-Solar-Data-Recorder-Incorrect-Access-Control.html · Exploit
• 🔥 https://github.com/nepenthe0320/cve_poc/blob/master/CVE-2019-11367 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-11367 · Security Note
• https://osv.dev/vulnerability/CVE-2019-11367 · Vendor Advisory