CVE-2019-19228

🗓️ 04 Dec 2019 18:52:09Reported by mitreType

cve🔗 web.nvd.nist.gov👁 78 Views🌐 WEB

Fronius Solar Inverter devices authentication bypass vulnerabilit

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2019-19228	7 Mar 202413:11	–	circl
CNVD	Fronius Solar Inverter Series Backdoor Account Vulnerability	4 Dec 201900:00	–	cnvd
Cvelist	CVE-2019-19228	4 Dec 201918:52	–	cvelist
Cvelist	CVE-2019-19229	4 Dec 201918:50	–	cvelist
EUVD	EUVD-2019-8854	7 Oct 202500:30	–	euvd
EUVD	EUVD-2019-8855	7 Oct 202500:30	–	euvd
NVD	CVE-2019-19228	4 Dec 201919:15	–	nvd
OSV	CVE-2019-19228	4 Dec 201919:15	–	osv
OSV	CVE-2019-19229	4 Dec 201919:15	–	osv
Packet Storm	Fronius Solar Inverter Series Insecure Communication / Path Traversal	4 Dec 201900:00	–	packetstorm

NVD

Node

fronius datamanager_box_2.0_firmwareRange<3.14.1

AND

fronius datamanager_box_2.0Match-

Node

fronius eco_25.0-3-s_firmwareRange<3.14.1

AND

fronius eco_25.0-3-sMatch-

Node

fronius eco_27.0-3-s_firmwareRange<3.14.1

AND

fronius eco_27.0-3-sMatch-

Node

fronius galvo_1.5-1_firmwareRange<3.14.1

AND

fronius galvo_1.5-1Match-

Node

fronius galvo_1.5-1_208-240_firmwareRange<3.14.1

AND

fronius galvo_1.5-1_208-240Match-

Node

fronius galvo_2.0-1_firmwareRange<3.14.1

AND

fronius galvo_2.0-1Match-

Node

fronius galvo_2.0-1_208-240_firmwareRange<3.14.1

AND

fronius galvo_2.0-1_208-240Match-

Node

fronius galvo_2.5-1_firmwareRange<3.14.1

AND

fronius galvo_2.5-1Match-

Node

fronius galvo_2.5-1_208-240_firmwareRange<3.14.1

AND

fronius galvo_2.5-1_208-240Match-

Node

fronius galvo_3.0-1_firmwareRange<3.14.1

AND

fronius galvo_3.0-1Match-

Node

fronius galvo_3.1-1_firmwareRange<3.14.1

AND

fronius galvo_3.1-1Match-

Node

fronius galvo_3.1-1_208-240_firmwareRange<3.14.1

AND

fronius galvo_3.1-1_208-240Match-

Node

fronius primo_10.0-1_208-240_firmwareRange<3.14.1

AND

fronius primo_10.0-1_208-240Match-

Node

fronius primo_11.4-1_208-240_firmwareRange<3.14.1

AND

fronius primo_11.4-1_208-240Match-

Node

fronius primo_12.5-1_208-240_firmwareRange<3.14.1

AND

fronius primo_12.5-1_208-240Match-

Node

fronius primo_15.0-1_208-240_firmwareRange<3.14.1

AND

fronius primo_15.0-1_208-240Match-

Node

fronius primo_3.0-1_firmwareRange<3.14.1

AND

fronius primo_3.0-1Match-

Node

fronius primo_3.5-1_firmwareRange<3.14.1

AND

fronius primo_3.5-1Match-

Node

fronius primo_3.6-1_firmwareRange<3.14.1

AND

fronius primo_3.6-1Match-

Node

fronius primo_3.8-1_208-240_firmwareRange<3.14.1

AND

fronius primo_3.8-1_208-240Match-

Node

fronius primo_4.0-1_firmwareRange<3.14.1

AND

fronius primo_4.0-1Match-

Node

fronius primo_4.6-1_firmwareRange<3.14.1

AND

fronius primo_4.6-1Match-

Node

fronius primo_5.0-1_firmwareRange<3.14.1

AND

fronius primo_5.0-1Match-

Node

fronius primo_5.0-1_208-240_firmwareRange<3.14.1

AND

fronius primo_5.0-1_208-240Match-

Node

fronius primo_5.0-1_aus_firmwareRange<3.14.1

AND

fronius primo_5.0-1_ausMatch-

Node

fronius primo_5.0-1_sc_firmwareRange<3.14.1

AND

fronius primo_5.0-1_scMatch-

Node

fronius primo_6.0-1_firmwareRange<3.14.1

AND

fronius primo_6.0-1Match-

Node

fronius primo_6.0-1_208-240_firmwareRange<3.14.1

AND

fronius primo_6.0-1_208-240Match-

Node

fronius primo_7.6-1_208-240_firmwareRange<3.14.1

AND

fronius primo_7.6-1_208-240Match-

Node

fronius primo_8.2-1_firmwareRange<3.14.1

AND

fronius primo_8.2-1Match-

Node

fronius primo_8.2-1_208-240_firmwareRange<3.14.1

AND

fronius primo_8.2-1_208-240Match-

Node

fronius symo_10.0-3-m_firmwareRange<3.14.1

AND

fronius symo_10.0-3-mMatch-

Node

fronius symo_10.0-3-m-os_firmwareRange<3.14.1

AND

fronius symo_10.0-3-m-osMatch-

Node

fronius symo_10.0-3_208-240_firmwareRange<3.14.1

AND

fronius symo_10.0-3_208-240Match-

Node

fronius symo_10.0-3_480_firmwareRange<3.14.1

AND

fronius symo_10.0-3_480Match-

Node

fronius symo_12.0-3_208-240_firmwareRange<3.14.1

AND

fronius symo_12.0-3_208-240Match-

Node

fronius symo_12.5-3-m_firmwareRange<3.14.1

AND

fronius symo_12.5-3-mMatch-

Node

fronius symo_12.5-3_480_firmwareRange<3.14.1

AND

fronius symo_12.5-3_480Match-

Node

fronius symo_15.0-3-m_firmwareRange<3.14.1

AND

fronius symo_15.0-3-mMatch-

Node

fronius symo_15.0-3_107_firmwareRange<3.14.1

AND

fronius symo_15.0-3_107Match-

Node

fronius symo_15.0-3_480_firmwareRange<3.14.1

AND

fronius symo_15.0-3_480Match-

Node

fronius symo_17.5-3-m_firmwareRange<3.14.1

AND

fronius symo_17.5-3-mMatch-

Node

fronius symo_17.5-3_480_firmwareRange<3.14.1

AND

fronius symo_17.5-3_480Match-

Node

fronius symo_20.0-3-m_firmwareRange<3.14.1

AND

fronius symo_20.0-3-mMatch-

Node

fronius symo_20.0-3_480_firmwareRange<3.14.1

AND

fronius symo_20.0-3_480Match-

Node

fronius symo_22.7-3_480_firmwareRange<3.14.1

AND

fronius symo_22.7-3_480Match-

Node

fronius symo_24.0-3_480_firmwareRange<3.14.1

AND

fronius symo_24.0-3_480Match-

Node

fronius symo_3.0-3-m_firmwareRange<3.14.1

AND

fronius symo_3.0-3-mMatch-

Node

fronius symo_3.0-3-s_firmwareRange<3.14.1

AND

fronius symo_3.0-3-sMatch-

Node

fronius symo_3.7-3-m_firmwareRange<3.14.1

AND

fronius symo_3.7-3-mMatch-

Node

fronius symo_3.7-3-s_firmwareRange<3.14.1

AND

fronius symo_3.7-3-sMatch-

Node

fronius symo_4.5-3-m_firmwareRange<3.14.1

AND

fronius symo_4.5-3-mMatch-

Node

fronius symo_4.5-3-s_firmwareRange<3.14.1

AND

fronius symo_4.5-3-sMatch-

Node

fronius symo_5.0-3-m_firmwareRange<3.14.1

AND

fronius symo_5.0-3-mMatch-

Node

fronius symo_6.0-3-m_firmwareRange<3.14.1

AND

fronius symo_6.0-3-mMatch-

Node

fronius symo_7.0-3-m_firmwareRange<3.14.1

AND

fronius symo_7.0-3-mMatch-

Node

fronius symo_8.2-3-m_firmwareRange<3.14.1

AND

fronius symo_8.2-3-mMatch-

Node

fronius symo_advanced_10.0-3_208-240_firmwareRange<3.14.1

AND

fronius symo_advanced_10.0-3_208-240Match-

Node

fronius symo_advanced_12.0-3_208-240_firmwareRange<3.14.1

AND

fronius symo_advanced_12.0-3_208-240Match-

Node

fronius symo_advanced_15.0-3_480_firmwareRange<3.14.1

AND

fronius symo_advanced_15.0-3_480Match-

Node

fronius symo_advanced_20.0-3_480_firmwareRange<3.14.1

AND

fronius symo_advanced_20.0-3_480Match-

Node

fronius symo_advanced_22.7-3_480_firmwareRange<3.14.1

AND

fronius symo_advanced_22.7-3_480Match-

Node

fronius symo_advanced_24.0-3_480_firmwareRange<3.14.1

AND

fronius symo_advanced_24.0-3_480Match-

Node

fronius symo_hybrid_3.0-3-m_firmwareRange<3.14.1

AND

fronius symo_hybrid_3.0-3-mMatch-

Node

fronius symo_hybrid_4.0-3-m_firmwareRange<3.14.1

AND

fronius symo_hybrid_4.0-3-mMatch-

Node

fronius symo_hybrid_5.0-3-m_firmwareRange<3.14.1

AND

fronius symo_hybrid_5.0-3-mMatch-

Source	Link
seclists	www.seclists.org/bugtraq/2019/Dec/5
sec-consult	www.sec-consult.com/en/blog/advisories/multiple-vulnerabilites-in-fronius-solar-inverter-series-cve-2019-19229-cve-2019-19228/
packetstormsecurity	www.packetstormsecurity.com/files/155562/Fronius-Solar-Inverter-Series-Insecure-Communication-Path-Traversal.html

Parameter	Position	Path	Description	CWE
action	query param	admincgi-bin/service.fcgi	Authenticated path traversal vulnerability leading to arbitrary file access via endpoint /admincgi-bin/service.fcgi (sample exploit reads /etc/shadow).	CWE-312
filename	query param	admincgi-bin/service.fcgi	Authenticated path traversal vulnerability leading to arbitrary file access via endpoint /admincgi-bin/service.fcgi (sample exploit reads /etc/shadow).	CWE-312

21 Nov 2024 04:34Current

9.5High risk

Vulners AI Score9.5

CVSS 25

CVSS 3.19.8

EPSS0.0024

CWE-312