9.1

CVE-2019-19885

In Bender COMTRAXX, user authorization is validated for most, but not all, routes in the system. A user with knowledge about the routes can read and write configuration data without prior authorization. This affects COM465IP, COM465DP, COM465ID, CP700, CP907, and CP915 devices before 4.2.0.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Bender ≫ Com465ip Firmware Version < 4.2.0
   Bender ≫ Com465ip Version -
Bender ≫ Com465dp Firmware Version < 4.2.0
   Bender ≫ Com465dp Version -
Bender ≫ Com465id Firmware Version < 4.2.0
   Bender ≫ Com465id Version -
Bender ≫ Cp700 Firmware Version < 4.2.0
   Bender ≫ Cp700 Version -
Bender ≫ Cp907 Firmware Version < 4.2.0
   Bender ≫ Cp907 Version -
Bender ≫ Cp915 Firmware Version < 4.2.0
   Bender ≫ Cp915 Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1% 0.587
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.1 3.9 5.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NIST 6.4 10 4.9
AV:N/AC:L/Au:N/C:P/I:P/A:N
CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

https://cert.vde.com/en-us/advisories/vde-2020-043
Third Party Advisory