CVE-2019-12254
TECSON/GOK: Improper Authentication and Access Control on multiple devices
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in V6.32, V6.3
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In multiple Tecson Tankspion and GOKs SmartBox 4 products the affected application doesn't properly restrict access to an endpoint that is responsible for saving settings, to a unauthenticated user with limited access rights. Based on the lack of adequately implemented access-control rules, by accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to change the application settings without authenticating at all, which violates originally laid ACL rules.
Timeline
- CVE published
- Record last updated
Affected versions
- TECSON e-litro net
fixed in V6.32
- TECSON LX-Net
fixed in V6.32
- TECSON LX-Q-Net
fixed in V6.32
- GOK SmartBox 4 LAN
fixed in V6.3
- GOK SmartBox 4 LAN PRO
fixed in V6.3