PT-2019-18140 · Unknown · Modbus Gateway

Published 2019-02-12 · Updated 2023-01-31 · CVE-2019-6527

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Modbus gateway versions prior to Release R02 (or Software Version 1.1.13166)

Description The issue allows an attacker to change the password for an admin user who is currently or previously logged in, provided the device has not been restarted.

Recommendations For Modbus gateway versions prior to Release R02 (or Software Version 1.1.13166), update to Release R02 or Software Version 1.1.13166 or later to resolve the issue.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2019-6527

Affected Products

Modbus Gateway

References · 3

• https://osv.dev/vulnerability/CVE-2019-6527 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-6527 · Security Note
• https://ics-cert.us-cert.gov/advisories/ICSA-19-036-05 · Note