CVE-2019-12254: TECSON e-litro net, заобикаляне на вход и права

Описание

Оригинално описание

In multiple Tecson Tankspion and GOKs SmartBox 4 products the affected application doesn't properly restrict access to an endpoint that is responsible for saving settings, to a unauthenticated user with limited access rights. Based on the lack of adequately implemented access-control rules, by accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to change the application settings without authenticating at all, which violates originally laid ACL rules.

Засегнати продукти

• TECSON e-litro net: unspecified преди V6.32
• TECSON LX-Net: unspecified преди V6.32
• TECSON LX-Q-Net: unspecified преди V6.32
• GOK SmartBox 4 LAN: unspecified преди V6.3
• GOK SmartBox 4 LAN PRO: unspecified преди V6.3

Вид слабост

• CWE-287 Неправилна автентикация

История

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2019-12254
• https://nvd.nist.gov/vuln/detail/CVE-2019-12254
• https://cert.vde.com/en/advisories/VDE-2019-012/