← Back

CVE-2019-14925

nvd nist
Published: Oct 28, 2019Modified: Nov 21, 2024

JSON object

Loading...
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Exploitability: 2.8 / Impact: 3.6
Source: NVD

Description

An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. A world-readable /usr/smartrtu/init/settings.xml configuration file on the file system allows an attacker to read sensitive configuration settings such as usernames, passwords, and other sensitive RTU data due to insecure permission assignment.

Affected (2)

Mitsubishielectric
1 product
Smartrtu Firmware
Inea
1 product
Me Rtu Firmware
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Smartrtu Firmware
Up to 2.02
Running on/withPlatform Versions
Mitsubishielectric
Smartrtu
All versions
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Me Rtu Firmware
Up to 3.0
Running on/withPlatform Versions
Inea
Me Rtu
All versions

Related CWEs

CWE-276
Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.

References (4)

Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
ExploitThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party Advisory

Timeline

No history available yet.