Lucene search

MitreCVE-2019-13379

HistoryJul 07, 2019 - 4:15 p.m.

CVE-2019-13379

2019-07-0716:15:10

CWE-668

mitre

web.nvd.nist.gov

cve-2019-13379

avtech

room alert 3e

privilege escalation

web interface

cmd.cgi

resetdefaults

default credentials

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.013

Percentile

85.9%

JSON

On AVTECH Room Alert 3E devices before 2.2.5, an attacker with access to the device’s web interface may escalate privileges from an unauthenticated user to administrator by performing a cmd.cgi?action=ResetDefaults&src=RA reset and using the default credentials to get in.

Affected configurations

Nvd

Node

avtechroom_alert_3e_firmwareRange<2.2.5

AND

avtechroom_alert_3eMatch-

VendorProductVersionCPE
avtechroom_alert_3e_firmware*cpe:2.3:o:avtech:room_alert_3e_firmware:*:*:*:*:*:*:*:*
avtechroom_alert_3e-cpe:2.3:h:avtech:room_alert_3e:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
avtech	room_alert_3e_firmware	*	cpe:2.3:o:avtech:room_alert_3e_firmware::::::::
avtech	room_alert_3e	-	cpe:2.3:h:avtech:room_alert_3e:-:::::::*

References

jordonlovik.wordpress.com/2019/07/06/roomalert-by-avtech-critical-vulnerability-disclosure/

psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010

www.youtube.com/watch?v=X1PY7kMFkVg

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.013

Percentile

85.9%

JSON

Related for CVE-2019-13379