PT-2019-13356 · Telestar+3 · Telestar Bobs Rock Radio+11

Benjamin K.M · Published 2019-09-13 · Updated 2023-09-05 · CVE-2019-13474

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TELESTAR Bobs Rock Radio version (affected versions not specified) Dabman D10 version (affected versions not specified) Dabman i30 Stereo version (affected versions not specified) Imperial i110 version (affected versions not specified) Imperial i150 version (affected versions not specified) Imperial i200 version (affected versions not specified) Imperial i200-cd version (affected versions not specified) Imperial i400 version (affected versions not specified) Imperial i450 version (affected versions not specified) Imperial i500-bt version (affected versions not specified) Imperial i600 TN81HH96-g102h-g102 version (affected versions not specified)

Description The issue is related to insufficient access control for various commands. The affected commands include /set dname, /mylogo, /LocalPlay, /irdevice.xml, /Sendkey, /setvol, /hotkeylist, /init, /playlogo.jpg, /stop, /exit, /back, and /playinfo.

Recommendations For TELESTAR Bobs Rock Radio, restrict access to the /set dname, /mylogo, /LocalPlay, /irdevice.xml, /Sendkey, /setvol, /hotkeylist, /init, /playlogo.jpg, /stop, /exit, /back, and /playinfo commands until a fix is available. For Dabman D10, restrict access to the /set dname, /mylogo, /LocalPlay, /irdevice.xml, /Sendkey, /setvol, /hotkeylist, /init, /playlogo.jpg, /stop, /exit, /back, and /playinfo commands until a fix is available. For Dabman i30 Stereo, restrict access to the /set dname, /mylogo, /LocalPlay, /irdevice.xml, /Sendkey, /setvol, /hotkeylist, /init, /playlogo.jpg, /stop, /exit, /back, and /playinfo commands until a fix is available. For Imperial i110, restrict access to the /set dname, /mylogo, /LocalPlay, /irdevice.xml, /Sendkey, /setvol, /hotkeylist, /init, /playlogo.jpg, /stop, /exit, /back, and /playinfo commands until a fix is available. For Imperial i150, restrict access to the /set dname, /mylogo, /LocalPlay, /irdevice.xml, /Sendkey, /setvol, /hotkeylist, /init, /playlogo.jpg, /stop, /exit, /back, and /playinfo commands until a fix is available. For Imperial i200, restrict access to the /set dname, /mylogo, /LocalPlay, /irdevice.xml, /Sendkey, /setvol, /hotkeylist, /init, /playlogo.jpg, /stop, /exit, /back, and /playinfo commands until a fix is available. For Imperial i200-cd, restrict access to the /set dname, /mylogo, /LocalPlay, /irdevice.xml, /Sendkey, /setvol, /hotkeylist, /init, /playlogo.jpg, /stop, /exit, /back, and /playinfo commands until a fix is available. For Imperial i400, restrict access to the /set dname, /mylogo, /LocalPlay, /irdevice.xml, /Sendkey, /setvol, /hotkeylist, /init, /playlogo.jpg, /stop, /exit, /back, and /playinfo commands until a fix is available. For Imperial i450, restrict access to the /set dname, /mylogo, /LocalPlay, /irdevice.xml, /Sendkey, /setvol, /hotkeylist, /init, /playlogo.jpg, /stop, /exit, /back, and /playinfo commands until a fix is available. For Imperial i500-bt, restrict access to the /set dname, /mylogo, /LocalPlay, /irdevice.xml, /Sendkey, /setvol, /hotkeylist, /init, /playlogo.jpg, /stop, /exit, /back, and /playinfo commands until a fix is available. For Imperial i600 TN81HH96-g102h-g102, restrict access to the /set dname, /mylogo, /LocalPlay, /irdevice.xml, /Sendkey, /setvol, /hotkeylist, /init, /playlogo.jpg, /stop, /exit, /back, and /playinfo commands until a fix is available.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

ALT-PU-2019-2687

ALT-PU-2019-2690

CVE-2019-13474

Affected Products

Alt Linux

Dabman D10

Dabman I30 Stereo

Imperial I110

Imperial I150

Imperial I200

Imperial I200-Cd

Imperial I400

Imperial I450

Imperial I500-Bt

Imperial I600 Tn81Hh96-G102H-G102

Telestar Bobs Rock Radio

References · 20

• 🔥 https://vulnerability-lab.com/get_content.php?id=2183 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13485 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13451 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13452 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13455 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13474 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13274 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13486 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13484 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13273 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13473 · Security Note
• https://errata.altlinux.org/ALT-PU-2019-2687 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-13474 · Security Note
• https://errata.altlinux.org/ALT-PU-2019-2690 · Vendor Advisory
• http://seclists.org/fulldisclosure/2019/Sep/12 · Note