Lucene search

MitreCVE-2019-13140

HistorySep 16, 2019 - 5:15 p.m.

CVE-2019-13140

2019-09-1617:15:13

CWE-552

mitre

web.nvd.nist.gov

122

inteno

eg200

juci

acl

misconfiguration

user account

3des key

json commands

ubus

adamo telecom

http

vulnerability

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.023

Percentile

89.8%

JSON

Inteno EG200 EG200-WU7P1U_ADAMO3.16.4-190226_1650 routers have a JUCI ACL misconfiguration that allows the “user” account to extract the 3DES key via JSON commands to ubus. The 3DES key is used to decrypt the provisioning file provided by Adamo Telecom on a public URL via cleartext HTTP.

Affected configurations

Nvd

Node

intenogroupeg200_firmwareMatcheg200-wu7p1u_adamo3.16.4-190226_1650

AND

intenogroupeg200Match-

VendorProductVersionCPE
intenogroupeg200_firmwareeg200-wu7p1u_adamo3.16.4-190226_1650cpe:2.3:o:intenogroup:eg200_firmware:eg200-wu7p1u_adamo3.16.4-190226_1650:*:*:*:*:*:*:*
intenogroupeg200-cpe:2.3:h:intenogroup:eg200:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
intenogroup	eg200_firmware	eg200-wu7p1u_adamo3.16.4-190226_1650	cpe:2.3:o:intenogroup:eg200_firmware:eg200-wu7p1u_adamo3.16.4-190226_1650:::::::*
intenogroup	eg200	-	cpe:2.3:h:intenogroup:eg200:-:::::::*

References

packetstormsecurity.com/files/154494/Inteno-IOPSYS-Gateway-3DES-Key-Extraction-Improper-Access.html

twitter.com/GerardFuguet/status/1169298861782896642

www.exploit-db.com/docs/47397

www.exploit-db.com/exploits/47390

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.023

Percentile

89.8%

JSON

Related for CVE-2019-13140