PT-2019-12050

Name of the Vulnerable Software and Affected Versions Computrols CBAS version 18.0.0 Description The issue allows for Unauthenticated Reflected Cross-Site Scripting in the login page and password reset page. This is achieved via the username GET parameter in the API endpoint, specifically in the...

PT-2019-12054

Name of the Vulnerable Software and Affected Versions Computrols CBAS version 18.0.0 Description The issue is related to default credentials in the software. Recommendations For Computrols CBAS version 18.0.0, change the default credentials to strong, unique passwords to prevent unauthorized acce...

PT-2019-12056

Name of the Vulnerable Software and Affected Versions Computrols CBAS version 18.0.0 Description The issue allows authenticated blind SQL injection via the id GET parameter in the "index.php?m=servers&a=start pulling&id=" endpoint. This can be exploited as demonstrated by injecting a substring in...

PT-2019-12057

Name of the Vulnerable Software and Affected Versions Computrols CBAS version 18.0.0 Description The issue allows authentication bypass. Recommendations For version 18.0.0, update to a newer version that contains a fix for this issue...

PT-2019-12058

Name of the Vulnerable Software and Affected Versions Computrols CBAS version 18.0.0 Description The issue allows for authenticated command injection. Recommendations For version 18.0.0, update to a newer version that contains a fix for this issue...

PT-2019-12055

Name of the Vulnerable Software and Affected Versions Computrols CBAS version 18.0.0 Description The issue concerns hard-coded encryption keys in the software. Recommendations For version 18.0.0, consider changing the hard-coded encryption keys to unique, user-defined keys to mitigate the risk of...

Computrols CBAS Web Authentication Bypass Vulnerability

CBAS Web is a Web-based building management system BMS from Computrols. An authentication bypass vulnerability exists in Computrols CBAS Web. An unauthenticated attacker could use this vulnerability to bypass authentication and gain full control of the device...

Computrols CBAS Insufficient Encryption Strength Vulnerability

CBAS Web is a Web-based building management system BMS from Computrols. Computrols CBAS Web suffers from an insufficient encryption strength vulnerability. The vulnerability stems from the fact that this application stores passwords in a database using MD5 hashes, and the MD5 algorithm is...

CVE-2019-10851: Use of Hard-coded Credentials

Computrols CBAS 18.0.0 has hard-coded encryption keys...

CVE-2019-10850: Use of Hard-coded Credentials

Computrols CBAS 18.0.0 has Default Credentials...

PT-2019-12053

Name of the Vulnerable Software and Affected Versions Computrols CBAS version 18.0.0 Description The issue allows for unprotected Subversion SVN directory and source code disclosure. Recommendations For Computrols CBAS version 18.0.0, consider restricting access to the SVN directory to minimize t...

CVE-2019-10855: Inadequate Encryption Strength

Computrols CBAS 18.0.0 mishandles password hashes. The approach is MD5 with a pw prefix, e.g., if the password is admin, it will calculate the MD5 hash of pwadmin and store it in a MySQL database...

PT-2019-12059

Name of the Vulnerable Software and Affected Versions Computrols CBAS version 18.0.0 Description The issue concerns the mishandling of password hashes. Specifically, it uses the MD5 hashing algorithm with a 'pw' prefix. For example, if the password is 'admin', it calculates the MD5 hash of...

Computrols CBAS Web

1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Computrols Equipment: CBAS Web Vulnerabilities: Cross-site Request Forgery, Information Exposure Through Discrepancy, Cross-site Scripting, Command Injection, Information Exposure Through Source...