PT-2019-13869 · Mitsubishi · Me-Rtu

Published 2019-10-28 · Updated 2024-09-10 · CVE-2019-14927

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mitsubishi Electric Europe B.V. ME-RTU devices versions 2.02 and earlier INEA ME-RTU devices versions 3.0 and earlier

Description An unauthenticated remote configuration download issue allows an attacker to download the smartRTU's configuration file, which contains sensitive data such as usernames, passwords, and other RTU data.

Recommendations For Mitsubishi Electric Europe B.V. ME-RTU devices versions 2.02 and earlier, consider restricting access to the configuration download feature until a patch is available. For INEA ME-RTU devices versions 3.0 and earlier, consider disabling remote configuration downloads as a temporary workaround until a fix is provided. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authentication

Weakness Enumeration

CWE-306

CWE-425

Related Identifiers

CVE-2019-14927

Affected Products

Me-Rtu

References · 6

• 🔥 https://exploit-db.com/exploits/47234 · Exploit
• 🔥 https://mogozobo.com/?p=3593 · Exploit
• https://osv.dev/vulnerability/CVE-2019-14927 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-14927 · Security Note
• https://t.me/cvenotify/94042 · Telegram Post
• https://mogozobo.com · Note