« Volver al listado

CVE-2019-19885

Estado: ModificadaCrítica (9.1)—

In Bender COMTRAXX, user authorization is validated for most, but not all, routes in the system. A user with knowledge about the routes can read and write configuration data without prior authorization. This affects COM465IP, COM465DP, COM465ID, CP700, CP907, and CP915 devices before 4.2.0.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (6)

Bender — Com465dp FirmwareBender — Com465id FirmwareBender — Com465ip FirmwareBender — Cp700 FirmwareBender — Cp907 FirmwareBender — Cp915 Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-19885",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.1,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-10-16T13:15:11.627",
  "references": [
    {
      "url": "https://cert.vde.com/en-us/advisories/vde-2020-043",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://cert.vde.com/en-us/advisories/vde-2020-043",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Bender COMTRAXX, user authorization is validated for most, but not all, routes in the system. A user with knowledge about the routes can read and write configuration data without prior authorization. This affects COM465IP, COM465DP, COM465ID, CP700, CP907, and CP915 devices before 4.2.0."
    },
    {
      "lang": "es",
      "value": "En Bender COMTRAXX, la autorización del usuario es comprobada para la mayoría, pero no para todas, las rutas del sistema. Un usuario con conocimiento de las rutas puede leer y escribir datos de configuración sin autorización previa. Esto afecta a los dispositivos COM465IP, COM465DP, COM465ID, CP700, CP907 y CP915 versiones anteriores a 4.2.0"
    }
  ],
  "lastModified": "2026-06-17T02:27:23.560",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:bender:com465ip_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CE5109B2-F9D4-4C3E-AC9F-4A1C1078E64A",
              "versionEndExcluding": "4.2.0"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:bender:com465ip:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "D272A06F-2B88-47CF-BAE9-AF029695C7CA"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:bender:com465dp_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3A7BB1CB-E494-4DFE-8CE1-67E78802824A",
              "versionEndExcluding": "4.2.0"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:bender:com465dp:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "497AFEB5-1E9C-4354-B8D4-6BDB7B5020E9"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:bender:com465id_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A4B2C77A-9225-4750-8C07-9CEB7E1EDBE9",
              "versionEndExcluding": "4.2.0"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:bender:com465id:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A876064E-B346-44FA-A59D-35CE79B4A8C9"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:bender:cp700_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F11D82EA-8B05-47F9-97AA-D5F3A04EA694",
              "versionEndExcluding": "4.2.0"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:bender:cp700:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "4A1A7F6A-D1A3-4AFE-A023-C7BB78E59073"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:bender:cp907_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B6B069D7-C1D5-4913-AFE1-51CBF43A8EA3",
              "versionEndExcluding": "4.2.0"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:bender:cp907:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "4620D993-E34E-447D-ADAD-E538D79E0477"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:bender:cp915_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CDB28BAA-1E85-4484-B22B-1745785EB2A9",
              "versionEndExcluding": "4.2.0"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:bender:cp915:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "B0B2C34E-9973-4C72-A213-8BA5E8A216F7"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}