CVE-2019-19885: Critical severity bender com465ip vulnerability

Q: Which devices are affected?

The issue affects COM465IP, COM465DP, COM465ID, CP700, CP907, and CP915 devices running firmware versions before 4.2.0.

Q: Does an attacker need an account or user interaction to exploit this issue?

No. The CVSS vector indicates network exploitation with no privileges required and no user interaction. An attacker needs knowledge of routes that do not enforce authorization.

Q: What could an unauthorized attacker do?

An attacker can read and modify configuration data through routes where user authorization is not validated. The reported impact includes high confidentiality and integrity impact.

Q: What is the available remediation?

Update affected devices to firmware version 4.2.0 or later. The issue applies to versions before 4.2.0.

Published Oct 16, 2020

Updated

In Bender COMTRAXX, user authorization is validated for most, but not all, routes in the system. A user with knowledge about the routes can read and write configuration data without prior authorization. This affects COM465IP, COM465DP, COM465ID, CP700, CP907, and CP915 devices before 4.2.0.

Affected Software

12 affected components

Bender Com465ip Firmware<4.2.0

Bender COM465IP

Bender Com465dp Firmware<4.2.0

Bender COM465DP

Bender Com465id Firmware<4.2.0

Bender COM465ID

Bender Cp700 Firmware<4.2.0

Bender CP700

Bender Cp907 Firmware<4.2.0

Bender CP907

Bender Cp915 Firmware<4.2.0

Bender CP915

Event History

Oct 16, 2020

CVE Published

via MITRE·12:55 PM

Data Sourced

via MITRE·12:55 PM

Description

Frequently Asked Questions

Which devices are affected?

The issue affects COM465IP, COM465DP, COM465ID, CP700, CP907, and CP915 devices running firmware versions before 4.2.0.

Does an attacker need an account or user interaction to exploit this issue?

No. The CVSS vector indicates network exploitation with no privileges required and no user interaction. An attacker needs knowledge of routes that do not enforce authorization.

What could an unauthorized attacker do?

An attacker can read and modify configuration data through routes where user authorization is not validated. The reported impact includes high confidentiality and integrity impact.

What is the available remediation?

Update affected devices to firmware version 4.2.0 or later. The issue applies to versions before 4.2.0.

CVE-2019-19885: Critical severity bender com465ip vulnerability

Affected Software

Event History

Frequently Asked Questions

Which devices are affected?

Does an attacker need an account or user interaction to exploit this issue?

What could an unauthorized attacker do?

What is the available remediation?

Company

Resources

Contact

Frequently Asked Questions

Which devices are affected?

Does an attacker need an account or user interaction to exploit this issue?

What could an unauthorized attacker do?

What is the available remediation?