PT-2019-12354 · Anviz · Anviz Global M3 Outdoor Rfid Access Control

Published 2019-05-23 · Updated 2020-08-24 · CVE-2019-11523

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Anviz Global M3 Outdoor RFID Access Control (affected versions not specified)

Description The issue allows attackers to execute any command on the device without authentication or encryption. This enables full interaction with the device, including sending commands like "open door", downloading the users list which contains RFID codes and passcodes in cleartext, or updating/creating users. The attack can be performed both on a local network and over the internet if the device is exposed to a public IP address.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Encryption of Sensitive Data

Missing Authentication

Weakness Enumeration

CWE-311

CWE-306

Related Identifiers

CVE-2019-11523

Affected Products

Anviz Global M3 Outdoor Rfid Access Control

References · 3

• 🔥 https://github.com/wizlab-it/anviz-m3-rfid-cve-2019-11523-poc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-11523 · Security Note
• https://t.me/defcon_news/14516 · Telegram Post