PT-2022-8079 · Goks+1 · Goks Smartbox 4+1

Maxim Rupp · Published 2022-05-06 · Updated 2022-05-16 · CVE-2019-12254

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Tecson Tankspion (affected versions not specified) GOKs SmartBox 4 (affected versions not specified)

Description The affected application does not properly restrict access to an endpoint responsible for saving settings, allowing an unauthenticated user with limited access rights to change application settings without authenticating. This is due to the lack of adequately implemented access-control rules, which can be exploited by accessing a specific uniform resource locator (URL) on the web server, violating the originally laid ACL rules.

Recommendations For Tecson Tankspion, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For GOKs SmartBox 4, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2019-12254

Affected Products

Goks Smartbox 4

Tecson Tankspion

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2019-12254 · Security Note
• https://t.me/cvenotify/29820 · Telegram Post
• https://t.me/cvenotify/30290 · Telegram Post
• https://t.me/cibsecurity/42158 · Telegram Post
• https://cert.vde.com/en/advisories/VDE-2019-012 · Note