PT-2019-9656 · Columbia Weather · Columbia Weather Microserver

John Elder + 1 · Published 2019-06-18 · Updated 2019-06-18 · CVE-2018-18877

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Columbia Weather MicroServer version MS 2.6.9900

Description The issue allows an authenticated web user to access an alternative configuration page, specifically the config main.php page, which enables manipulation of the device.

Recommendations For version MS 2.6.9900, restrict access to the config main.php page to prevent unauthorized device manipulation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2018-18877

Affected Products

Columbia Weather Microserver

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-18877 · Security Note
• https://osv.dev/vulnerability/CVE-2018-18877 · Vendor Advisory
• https://ics-cert.us-cert.gov/advisories/ICSA-19-078-02 · Note
• https://applied-risk.com/labs/advisories · Note