CVE-2019-12254
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
In multiple Tecson Tankspion and GOKs SmartBox 4 products the affected application doesn't properly restrict access to an endpoint that is responsible for saving settings, to a unauthenticated user with limited access rights. Based on the lack of adequately implemented access-control rules, by accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to change the application settings without authenticating at all, which violates originally laid ACL rules.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| TECSON | e-litro net | unspecified < V6.32 | affected |
| TECSON | LX-Net | unspecified < V6.32 | affected |
| TECSON | LX-Q-Net | unspecified < V6.32 | affected |
| GOK | SmartBox 4 LAN | unspecified < V6.3 | affected |
| GOK | SmartBox 4 LAN PRO | unspecified < V6.3 | affected |
Weaknesses
- CWE-287: CWE-287 Improper Authentication
ADP Enrichment
CVE Program Container
Additional References
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.