CVE-2019-14925: Medium severity mitsubishielectric smartrtu firmware vulnerability
An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. A world-readable /usr/smartrtu/init/settings.xml configuration file on the file system allows an attacker to read sensitive configuration settings such as usernames, passwords, and other sensitive RTU data due to insecure permission assignment.
Other sources
An issue was discovered on Mitsubishi Electric ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. A world-readable /usr/smartrtu/init/settings.xml configuration file on the file system allows an attacker to read sensitive configuration settings such as usernames, passwords, and other sensitive RTU data due to insecure permission assignment.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-14925?
CVE-2019-14925 is a vulnerability found in Mitsubishi Electric ME-RTU devices and INEA ME-RTU devices that allows an attacker to read sensitive configuration settings.
How can an attacker exploit CVE-2019-14925?
An attacker can exploit CVE-2019-14925 by accessing the world-readable /usr/smartrtu/init/settings.xml configuration file on the file system.
What information can an attacker obtain from CVE-2019-14925?
An attacker can obtain sensitive configuration settings such as usernames, passwords, and other data.
Which devices are affected by CVE-2019-14925?
Mitsubishi Electric ME-RTU devices through version 2.02 and INEA ME-RTU devices through version 3.0 are affected by CVE-2019-14925.
What is the severity of CVE-2019-14925?
CVE-2019-14925 has a severity rating of 6.5, which is considered medium.
How can I mitigate the vulnerability CVE-2019-14925?
To mitigate CVE-2019-14925, it is recommended to apply the necessary security updates or patches provided by Mitsubishi Electric or INEA.