CVE-2019-7272

CVE-2019-7272 affects Optergy Proton/Enterprise (versions ≤ 2.3.0a). The vulnerability is an information exposure via the username reset functionality, enabling an unauthorized attacker to enumerate usernames and, per Red Hat/CISA references, reveal internal details on the targeted system. Public...

CVE-2019-7273

CVE-2019-7273 affects Optergy Proton/Enterprise Building Management Systems (versions ≤ 2.3.0a). The issue is Cross-Site Request Forgery (CSRF) that can enable an attacker to perform privileged actions (e.g., adding an admin) via forged requests from a logged-in user. Public PoCs/exploits exist (...

CVE-2019-7273

Optergy Proton/Enterprise devices allow Cross-Site Request Forgery CSRF...

CVE-2019-7274

Optergy Proton/Enterprise devices allow Authenticated File Upload with Code Execution as root...

CVE-2019-7274

CVE-2019-7274 affects Optergy Proton/Enterprise. The vulnerability is an authenticated file upload that can lead to remote code execution as root in Optergy Proton/Enterprise versions 2.3.0a and earlier. Public references describe an authenticated file-upload path enabling root access (RCE) and a...

CVE-2019-7275

CVE-2019-7275 affects Optergy Proton/Enterprise Building Management System (

CVE-2019-7275

Optergy Proton/Enterprise devices allow Open Redirect...

CVE-2019-7277

CVE-2019-7277 (Optergy Proton/Enterprise) affects Optergy Proton/Enterprise Building Management System. Public sources cite an unauthenticated internal network information disclosure vulnerability, enabling an attacker to obtain sensitive system details (e.g., internal IP, hostname, DNS informati...

CVE-2019-7277

Optergy Proton/Enterprise devices allow Unauthenticated Internal Network Information Disclosure...

CVE-2019-7278

CVE-2019-7278 affects Optergy Proton/Enterprise Building Management System. Root cause: Exposed Dangerous Method or Function (CWE-749) allowing unauthenticated access to a sensitive function. Impact: cryptic in public docs, but CVSSv3 base score is 7.3 (medium-high) with network access, no user i...

CVE-2019-7278

Optergy Proton/Enterprise devices have an Unauthenticated SMS Sending Service...

CVE-2019-7279

Optergy Proton/Enterprise devices have Hard-coded Credentials...

CVE-2019-7279

Optergy Proton/Enterprise devices have Hard-coded Credentials...

Hardcoded credentials

Optergy Proton/Enterprise devices have Hard-coded Credentials...

CVE-2019-7279

Optergy Proton/Enterprise devices have Hard-coded Credentials...

CVE-2019-7279

Optergy Proton/Enterprise devices are affected by CVE-2019-7279, which involves hard-coded credentials in the system. The issue impacts Proton/Enterprise software (versions 2.3.0a and earlier) and is identified as Use of Hard-Coded Credentials (CWE-798). The NVD entry assigns CVSSv3 base score 7....

PT-2019-18506 · Optergy · Optergy Proton/Enterprise

Name of the Vulnerable Software and Affected Versions: Optergy Proton/Enterprise devices affected versions not specified Description: The issue allows for remote root code execution via a backdoor console. Recommendations: At the moment, there is no information about a newer version that contains...

CVE-2019-7276

Optergy Proton/Enterprise BMS is affected by CVE-2019-7276: unauthenticated remote code execution via a backdoor console. Public details show an undocumented backdoor script (Console.jsp) in the tools directory that enables full root access on vulnerable versions (notably 2.0.3a and earlier). Exp...

PT-2019-18503 · Optergy · Optergy Proton/Enterprise

Name of the Vulnerable Software and Affected Versions: Optergy Proton/Enterprise devices affected versions not specified Description: The issue allows Cross-Site Request Forgery CSRF, which is a type of attack that tricks a user into performing unintended actions on a web application...

PT-2019-18505 · Optergy · Optergy Proton/Enterprise

Name of the Vulnerable Software and Affected Versions: Optergy Proton/Enterprise affected versions not specified Description: The issue allows for Open Redirect, which could potentially be exploited by attackers to redirect users to malicious websites. Recommendations: At the moment, there is no...