Lucene search

MitreCVE-2019-14929

HistoryOct 28, 2019 - 1:15 p.m.

CVE-2019-14929

2019-10-2813:15:10

CWE-522

mitre

web.nvd.nist.gov

cve-2019-14929

mitsubishi electric

inea me-rtu

password security

weak credentials

ddns

mobile network

openvpn

vulnerability

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.006

Percentile

79.4%

JSON

An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. Stored cleartext passwords could allow an unauthenticated attacker to obtain configured username and password combinations on the RTU due to the weak credentials management on the RTU. An unauthenticated user can obtain the exposed password credentials to gain access to the following services: DDNS service, Mobile Network Provider, and OpenVPN service.

Affected configurations

Nvd

Node

mitsubishielectricsmartrtu_firmwareRange≤2.02

AND

mitsubishielectricsmartrtuMatch-

Node

ineame-rtu_firmwareRange≤3.0

AND

ineame-rtuMatch-

VendorProductVersionCPE
mitsubishielectricsmartrtu_firmware*cpe:2.3:o:mitsubishielectric:smartrtu_firmware:*:*:*:*:*:*:*:*
mitsubishielectricsmartrtu-cpe:2.3:h:mitsubishielectric:smartrtu:-:*:*:*:*:*:*:*
ineame-rtu_firmware*cpe:2.3:o:inea:me-rtu_firmware:*:*:*:*:*:*:*:*
ineame-rtu-cpe:2.3:h:inea:me-rtu:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mitsubishielectric	smartrtu_firmware	*	cpe:2.3:o:mitsubishielectric:smartrtu_firmware::::::::
mitsubishielectric	smartrtu	-	cpe:2.3:h:mitsubishielectric:smartrtu:-:::::::*
inea	me-rtu_firmware	*	cpe:2.3:o:inea:me-rtu_firmware::::::::
inea	me-rtu	-	cpe:2.3:h:inea:me-rtu:-:::::::*

References

www.mogozobo.com/

www.mogozobo.com/?p=3593

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.006

Percentile

79.4%

JSON

Related for CVE-2019-14929