CVE-2019-11326

An issue was discovered on Topcon Positioning Net-G5 GNSS Receiver devices with firmware 5.2.2. The web interface of the product is protected by a login. A guest is allowed to login. Once logged in as a guest, an attacker can browse a URL to read the password of the administrative user. The same procedure allows a regular user to gain administrative privileges. The guest login is possible in the default configuration.

CVSS v3 8.8 HIGH
CVSS v2.0 6.5 MEDIUM

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://mezdanak.de/2019/06/21/iot-full-disclosure-topcon-positioning-net-g5-receiver/	Third Party Advisory
https://mezdanak.de/2019/06/21/iot-full-disclosure-topcon-positioning-net-g5-receiver/	Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:topcon:net-g5_firmware:5.2.2:*:*:*:*:*:*:*

cpe:2.3:h:topcon:net-g5:-:*:*:*:*:*:*:*

History

21 Nov 2024, 04:20

Type	Values Removed	Values Added
References	~~() https://mezdanak.de/2019/06/21/iot-full-disclosure-topcon-positioning-net-g5-receiver/ - Third Party Advisory~~	() https://mezdanak.de/2019/06/21/iot-full-disclosure-topcon-positioning-net-g5-receiver/ - Third Party Advisory

Information

Published : 2019-09-20 19:15

Updated : 2024-11-21 04:20

NVD link : CVE-2019-11326

Mitre link : CVE-2019-11326

CVE.ORG link : CVE-2019-11326

JSON object : View

Products Affected

topcon

net-g5_firmware
net-g5

CWE

CWE-425

Direct Request ('Forced Browsing')

{"id": "CVE-2019-11326", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2019-09-20T19:15:11.487", "references": [{"url": "https://mezdanak.de/2019/06/21/iot-full-disclosure-topcon-positioning-net-g5-receiver/", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://mezdanak.de/2019/06/21/iot-full-disclosure-topcon-positioning-net-g5-receiver/", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-425"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered on Topcon Positioning Net-G5 GNSS Receiver devices with firmware 5.2.2. The web interface of the product is protected by a login. A guest is allowed to login. Once logged in as a guest, an attacker can browse a URL to read the password of the administrative user. The same procedure allows a regular user to gain administrative privileges. The guest login is possible in the default configuration."}, {"lang": "es", "value": "Se detect\u00f3 un problema en los dispositivos Topcon Positioning Net-G5 GNSS Receiver con versi\u00f3n de firmware 5.2.2. La interfaz web del producto est\u00e1 protegida mediante un inicio de sesi\u00f3n. Un invitado puede iniciar sesi\u00f3n. Una vez registrado como invitado, un atacante puede explorar una URL para leer la contrase\u00f1a del usuario administrativo. El mismo procedimiento permite a un usuario regular alcanzar privilegios administrativos. El inicio de sesi\u00f3n del invitado es posible en la configuraci\u00f3n predeterminada."}], "lastModified": "2024-11-21T04:20:53.650", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:topcon:net-g5_firmware:5.2.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6CFEFC2C-437F-4DEF-B719-6DAD6CA84A7F"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:topcon:net-g5:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "4E6938C5-430F-41A6-AEE0-40E460D1C94A"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}