PT-2019-4705 · Anviz · Crosschex

Pedro Sousa Rodrigues + 1 · Published 2019-12-02 · Updated 2020-02-21 · CVE-2019-12518

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Anviz CrossChex access control management software versions 4.3.8.0 through 4.3.12

Description The issue is related to a buffer overflow vulnerability. It is caused by copying a buffer without checking the size of the input data. Exploitation of this issue may allow a remote attacker to execute arbitrary code in the target system by sending specially crafted network packets.

Recommendations For versions 4.3.8.0 through 4.3.12, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

BDU:2020-01210

CVE-2019-12518

Affected Products

Crosschex

References · 10

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/misc/crosschex_device_bof.rb · Exploit
• 🔥 https://0x90.zone/multiple/reverse/2019/11/28/Anviz-pwn.html · Exploit
• 🔥 https://exploit-db.com/exploits/48092 · Exploit
• https://bdu.fstec.ru/vul/2020-01210 · Security Note
• https://osv.dev/vulnerability/CVE-2019-12518 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12518 · Security Note
• http://packetstormsecurity.com/files/156335/Anviz-CrossChex-Buffer-Overflow.html · Note
• https://vuldb.com/ru/?id.146519 · Note
• https://packetstormsecurity.com/files/156335/Anviz-CrossChex-Buffer-Overflow.html · Note
• https://t.me/defcon_news/39252 · Telegram Post