PT-2020-10002 · Blaauw · Blaauw Remote Kiln Control

Published 2020-05-07 · Updated 2020-05-12 · CVE-2019-18871

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Blaauw Remote Kiln Control versions through v3.00r4

Description A path traversal issue in debug.php, accessed via default.php, allows an authenticated attacker to upload arbitrary files. This can lead to arbitrary remote code execution.

Recommendations For versions through v3.00r4, update to a version later than v3.00r4 to resolve the issue. As a temporary workaround, consider restricting access to debug.php and default.php to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2019-18871

Affected Products

Blaauw Remote Kiln Control

References · 5

• 🔥 https://github.com/lodestone-security/CVEs/blob/master/remote_kiln_control/an_unfortunate_kilnundrum.md · Exploit
• https://osv.dev/vulnerability/CVE-2019-18871 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-18871 · Security Note
• https://t.me/cibsecurity/11917 · Telegram Post
• https://t.me/cvenotify/3613 · Telegram Post