CVE-2019-19885

In Bender COMTRAXX, user authorization is validated for most, but not all, routes in the system. A user with knowledge about the routes can read and write configuration data without prior authorization. This affects COM465IP, COM465DP, COM465ID, CP700, CP907, and CP915 devices before 4.2.0.
References
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:bender:com465ip_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:bender:com465ip:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:bender:com465dp_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:bender:com465dp:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:bender:com465id_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:bender:com465id:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:bender:cp700_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:bender:cp700:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:bender:cp907_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:bender:cp907:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:bender:cp915_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:bender:cp915:-:*:*:*:*:*:*:*

History

21 Nov 2024, 04:35

Type Values Removed Values Added
References () https://cert.vde.com/en-us/advisories/vde-2020-043 - Third Party Advisory () https://cert.vde.com/en-us/advisories/vde-2020-043 - Third Party Advisory

Information

Published : 2020-10-16 13:15

Updated : 2024-11-21 04:35


NVD link : CVE-2019-19885

Mitre link : CVE-2019-19885

CVE.ORG link : CVE-2019-19885


JSON object : View

Products Affected

bender

  • com465dp
  • com465id
  • com465id_firmware
  • com465ip
  • cp907
  • cp700
  • cp700_firmware
  • cp915_firmware
  • cp915
  • com465dp_firmware
  • cp907_firmware
  • com465ip_firmware
CWE
CWE-862

Missing Authorization