CVE-2019-12254

{"containers": {"cna": {"affected": [{"product": "e-litro net", "vendor": "TECSON", "versions": [{"lessThan": "V6.32", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "LX-Net", "vendor": "TECSON", "versions": [{"lessThan": "V6.32", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "LX-Q-Net", "vendor": "TECSON", "versions": [{"lessThan": "V6.32", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "SmartBox 4 LAN", "vendor": "GOK", "versions": [{"lessThan": "V6.3", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "SmartBox 4 LAN PRO", "vendor": "GOK", "versions": [{"lessThan": "V6.3", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Maxim Rupp (rupp.it) reported this vulnerability to CERT@VDE."}], "datePublic": "2019-04-06T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "In multiple Tecson Tankspion and GOKs SmartBox 4 products the affected application doesn't properly restrict access to an endpoint that is responsible for saving settings, to a unauthenticated user with limited access rights. Based on the lack of adequately implemented access-control rules, by accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to change the application settings without authenticating at all, which violates originally laid ACL rules."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "description": "CWE-287 Improper Authentication", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-05-06T17:30:11.000Z", "orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://cert.vde.com/en/advisories/VDE-2019-012/"}], "solutions": [{"lang": "en", "value": "Upgrade to firmware version > 6.32"}], "source": {"advisory": "VDE-2019-012", "discovery": "EXTERNAL"}, "title": "TECSON/GOK: Improper Authentication and Access Control on multiple devices", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "info@cert.vde.com", "DATE_PUBLIC": "2019-04-06T10:00:00.000Z", "ID": "CVE-2019-12254", "STATE": "PUBLIC", "TITLE": "TECSON/GOK: Improper Authentication and Access Control on multiple devices"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "e-litro net", "version": {"version_data": [{"version_affected": "<", "version_value": "V6.32"}]}}, {"product_name": "LX-Net", "version": {"version_data": [{"version_affected": "<", "version_value": "V6.32"}]}}, {"product_name": "LX-Q-Net", "version": {"version_data": [{"version_affected": "<", "version_value": "V6.32"}]}}]}, "vendor_name": "TECSON"}, {"product": {"product_data": [{"product_name": "SmartBox 4 LAN", "version": {"version_data": [{"version_affected": "<", "version_value": "V6.3"}]}}, {"product_name": "SmartBox 4 LAN PRO", "version": {"version_data": [{"version_affected": "<", "version_value": "V6.3"}]}}]}, "vendor_name": "GOK"}]}}, "credit": [{"lang": "eng", "value": "Maxim Rupp (rupp.it) reported this vulnerability to CERT@VDE."}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "In multiple Tecson Tankspion and GOKs SmartBox 4 products the affected application doesn't properly restrict access to an endpoint that is responsible for saving settings, to a unauthenticated user with limited access rights. Based on the lack of adequately implemented access-control rules, by accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to change the application settings without authenticating at all, which violates originally laid ACL rules."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-287 Improper Authentication"}]}]}, "references": {"reference_data": [{"name": "https://cert.vde.com/en/advisories/VDE-2019-012/", "refsource": "CONFIRM", "url": "https://cert.vde.com/en/advisories/VDE-2019-012/"}]}, "solution": [{"lang": "en", "value": "Upgrade to firmware version > 6.32"}], "source": {"advisory": "VDE-2019-012", "discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T23:17:39.190Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://cert.vde.com/en/advisories/VDE-2019-012/"}]}]}, "cveMetadata": {"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "assignerShortName": "CERTVDE", "cveId": "CVE-2019-12254", "datePublished": "2022-05-06T17:30:12.071Z", "dateReserved": "2019-05-21T00:00:00.000Z", "dateUpdated": "2024-09-16T20:22:12.620Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "e-litro net", "vendor": "TECSON", "versions": [{"lessThan": "V6.32", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "LX-Net", "vendor": "TECSON", "versions": [{"lessThan": "V6.32", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "LX-Q-Net", "vendor": "TECSON", "versions": [{"lessThan": "V6.32", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "SmartBox 4 LAN", "vendor": "GOK", "versions": [{"lessThan": "V6.3", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "SmartBox 4 LAN PRO", "vendor": "GOK", "versions": [{"lessThan": "V6.3", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "source": "info@cert.vde.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:gok:smartbox_4_lan_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "4C9385EB-5444-400B-8E50-D2BE1813EFD1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:gok:smartbox_4_lan:-:*:*:*:*:*:*:*", "matchCriteriaId": "7F9081DF-4A88-4693-9F02-0554C3DBE67E", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:gok:smartbox_4_lan_pro_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "E666749C-0320-493E-B4FB-25E52D376F6F", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:gok:smartbox_4_lan_pro:-:*:*:*:*:*:*:*", "matchCriteriaId": "A7BBB65A-A593-43EE-A781-56D837C5C904", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tecson:lx-q-net_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "BC2D7550-F679-40C8-84FE-D26450F0006F", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tecson:lx-q-net:-:*:*:*:*:*:*:*", "matchCriteriaId": "CA2F641C-4883-460E-8B49-DE793C495961", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tecson:lx-net_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "4749C693-6D51-4067-9B52-9A03811D4F35", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tecson:lx-net:-:*:*:*:*:*:*:*", "matchCriteriaId": "9692F473-3325-4EE5-9EA3-CD8975B260AC", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tecson:e-litro_net_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "355A7726-E136-4AB5-A09C-862D42A1B2E3", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tecson:e-litro_net:-:*:*:*:*:*:*:*", "matchCriteriaId": "AFFDE7D6-E2EF-40C3-B44A-7516A3F13703", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In multiple Tecson Tankspion and GOKs SmartBox 4 products the affected application doesn't properly restrict access to an endpoint that is responsible for saving settings, to a unauthenticated user with limited access rights. Based on the lack of adequately implemented access-control rules, by accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to change the application settings without authenticating at all, which violates originally laid ACL rules."}, {"lang": "es", "value": "En varios productos Tecson Tankspion y GOKs SmartBox 4, la aplicaci\u00f3n afectada no restringe apropiadamente el acceso a un endpoint que es responsable de guardar la configuraci\u00f3n, a un usuario no autenticado con derechos de acceso limitados. Bas\u00e1ndose en la falta de reglas de control de acceso adecuadamente implementadas, al acceder a un localizador uniforme de recursos (URL) espec\u00edfico en el servidor web, un usuario malicioso es capaz de cambiar la configuraci\u00f3n de la aplicaci\u00f3n sin autenticarse en absoluto, lo que viola las reglas ACL originalmente establecidas"}], "id": "CVE-2019-12254", "lastModified": "2026-06-17T02:14:18.553", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "info@cert.vde.com", "type": "Secondary"}]}, "published": "2022-05-06T18:15:08.397", "references": [{"source": "info@cert.vde.com", "tags": ["Third Party Advisory"], "url": "https://cert.vde.com/en/advisories/VDE-2019-012/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://cert.vde.com/en/advisories/VDE-2019-012/"}], "sourceIdentifier": "info@cert.vde.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "info@cert.vde.com", "type": "Secondary"}]}

{}

{}