9

CVE-2019-12775

Exploit
An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044_update_05032019-482. They allow high-privileged root access by www-data via sudo without requiring appropriate access control. (Furthermore, the user account that controls the web application service is granted full access to run any system commands with elevated privilege, without the need for password authentication. Should vulnerabilities be identified and exploited within the web application, it may be possible for a threat actor to create or run high-privileged binaries or executables that are available within the operating system of the device.)
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Enttec ≫ Datagate Mk2 Firmware Version70044 Update05032019-482
   Enttec ≫ Datagate Mk2 Version-
Enttec ≫ Storm 24 Firmware Version70044 Update05032019-482
   Enttec ≫ Storm 24 Version-
Enttec ≫ Pixelator Firmware Version70044 Update05032019-482
   Enttec ≫ Pixelator Version-
Enttec ≫ E-streamer Mk2 Firmware Version70044 Update05032019-482
   Enttec ≫ E-streamer Mk2 Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.83% 0.738
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.8 2.8 5.9
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 9 8 10
AV:N/AC:L/Au:S/C:C/I:C/A:C
CWE-269 Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

https://www.mogozobo.com/?p=3476
Third Party Advisory
Exploit