CVE-2019-11326

{"id": "CVE-2019-11326", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2019-09-20T19:15:11.487", "references": [{"url": "https://mezdanak.de/2019/06/21/iot-full-disclosure-topcon-positioning-net-g5-receiver/", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-425"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered on Topcon Positioning Net-G5 GNSS Receiver devices with firmware 5.2.2. The web interface of the product is protected by a login. A guest is allowed to login. Once logged in as a guest, an attacker can browse a URL to read the password of the administrative user. The same procedure allows a regular user to gain administrative privileges. The guest login is possible in the default configuration."}, {"lang": "es", "value": "Se detect\u00f3 un problema en los dispositivos Topcon Positioning Net-G5 GNSS Receiver con versi\u00f3n de firmware 5.2.2. La interfaz web del producto est\u00e1 protegida mediante un inicio de sesi\u00f3n. Un invitado puede iniciar sesi\u00f3n. Una vez registrado como invitado, un atacante puede explorar una URL para leer la contrase\u00f1a del usuario administrativo. El mismo procedimiento permite a un usuario regular alcanzar privilegios administrativos. El inicio de sesi\u00f3n del invitado es posible en la configuraci\u00f3n predeterminada."}], "lastModified": "2020-08-24T17:37:01.140", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:topcon:net-g5_firmware:5.2.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6CFEFC2C-437F-4DEF-B719-6DAD6CA84A7F"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:topcon:net-g5:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "4E6938C5-430F-41A6-AEE0-40E460D1C94A"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}