PT-2020-10046 · Busch Jaeger+1 · Busch-Jaeger 6186/11 Telefon-Gateway+1

Published 2020-04-22 · Updated 2021-11-03 · CVE-2019-19104

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions ABB Telephone Gateway TG/S version 3.2 Busch-Jaeger 6186/11 Telefon-Gateway (affected versions not specified)

Description The issue concerns unauthorized access to certain application endpoints without proper authentication by accessing a specific URL, which violates access-control rules. This allows for the potential obtaining of sensitive information, which could aid in further attacks and privilege escalation.

Recommendations For ABB Telephone Gateway TG/S version 3.2, update the access-control rules to enforce proper authentication for all endpoints. For Busch-Jaeger 6186/11 Telefon-Gateway, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Missing Authentication

Weakness Enumeration

CWE-287

CWE-306

Related Identifiers

CVE-2019-19104

Affected Products

Abb Telephone Gateway Tg/S

Busch-Jaeger 6186/11 Telefon-Gateway

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2019-19104 · Security Note
• https://search.abb.com/library/Download.aspx?DocumentID=9AKK107680A3921&LanguageCode=en&DocumentPartId=&Action=Launch · Vendor Advisory