CVE-2019-9484

{"id": "CVE-2019-9484", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2019-03-01T07:29:00.217", "references": [{"url": "https://medium.com/%40SergiuSechel/insecure-permissions-in-glen-dimplex-deutschland-gmbh-implementation-of-carel-pcoweb-configuration-ca3896f24835", "source": "cve@mitre.org"}, {"url": "https://medium.com/%40SergiuSechel/insecure-permissions-in-glen-dimplex-deutschland-gmbh-implementation-of-carel-pcoweb-configuration-ca3896f24835", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "The Glen Dimplex Deutschland GmbH implementation of the Carel pCOWeb configuration tool allows remote attackers to obtain access via an HTTP session on port 10000, as demonstrated by reading the modem password (which is 1234), or reconfiguring \"party mode\" or \"vacation mode.\""}, {"lang": "es", "value": "La implementaci\u00f3n de Glen Dimplex Deutschland GmbH de la herramienta de configuraci\u00f3n Carel pCOWeb permite que los atacantes remotos obtengan acceso mediante una sesi\u00f3n HTTP en el puerto 10000, tal y como queda demostrado con la lectura de la contrase\u00f1a del m\u00f3dem (1234) o con la reconfiguraci\u00f3n de los modos \"party\" o \"vacation\"."}], "lastModified": "2024-11-21T04:51:42.533", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:carel:pcoweb_card_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C8319F37-D9AD-4660-831B-656E52C7DAFC"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:carel:pcoweb_card:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "DE87B839-78E7-4789-9B5A-7EAB4834337B"}], "operator": "OR"}], "operator": "AND"}], "vendorComments": [{"comment": "Glen Dimplex Deutschland GmbH does not deliver the Carel pCOweb card with an open port 10000 or 10001. \nThe shown password \u20181234\u2019 on the webpage is not being used in any current application. \nIt was being used in former times together with a connection via modem, this is not realized anymore.\nMore details to the current application: www.dimplex.de/wiki.", "lastModified": "2020-05-29T13:03:44.587", "organization": "Glen Dimplex Deutschland GmbH"}], "sourceIdentifier": "cve@mitre.org"}