Search criteria
18 vulnerabilities found for Explorer 710 by Cobham plc
VAR-201910-1692
Vulnerability from variot - Updated: 2024-03-18 22:14The web root directory of the Cobham EXPLORER 710, firmware version 1.07, has no access restrictions on downloading and reading all files. This could allow an unauthenticated, local attacker connected to the device to access and download any file found in the web root directory. CERT/CC researchers examined the satcom terminal Cobham EXPLORER 710 as an expansion of work from IOActive’s findings in 2014. Cobham EXPLORER 710 is a portable satellite communications terminal used for satellite communications and Internet access. Cobham EXPLORER 710 The following multiple vulnerabilities exist in. CVE-2019-9529 Of the product Web The interface does not require authentication in its default state. Therefore, an attacker within the local network can Web The portal may be accessed and settings may be changed. Therefore, arbitrary files may be accessed by an attacker within the local network. CVE-2019-9531 Of the product 5454/tcp without authenticating to the port telnet connection is possible and telnet After connecting, 86 kind of Attention (AT) It is possible to execute commands. CVE-2019-9532 Of the product Web The interface sends the password for login in clear text. Therefore, password information may be stolen by an attacker within the local network. CVE-2019-9533 Firmware of the product v1.08 and all previous versions, the same root A password is used. By analyzing any applicable version of the firmware, an attacker can root It is possible to steal passwords. CVE-2019-9534 This product does not perform firmware image verification. Additionally, a development script left in the firmware allows you to upload and run a custom firmware image. Therefore, attackers within the local network can install tampered firmware, modify or steal communication content, install backdoors, and disrupt service operations. (DoS) Attacks may occur. In addition CERT/CC According to WiFi Because the password is set as HTTP It lacks headers and is also vulnerable to cross-site scripting and clickjacking attacks. These vulnerabilities are 2014 carried out in IOActive ’ s findings As a series of studies on CERT/CC newly discovered by researchers.The potential impact will vary for each vulnerability, but you may be affected by: * Leakage or falsification of information - CVE-2019-9529 , CVE-2019-9530 , CVE-2019-9531 , CVE-2019-9532 , CVE-2019-9533 , CVE-2019-9534 Execute arbitrary command - CVE-2019-9531 Service operation interruption (DoS) - CVE-2019-9534
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201910-1692",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "explorer 710",
"scope": "eq",
"trust": 1.0,
"vendor": "cobham",
"version": "1.07"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "cobham plc",
"version": null
},
{
"model": "explorer 710",
"scope": "eq",
"trust": 0.8,
"vendor": "cobham plc",
"version": null
},
{
"model": "explorer 710",
"scope": "eq",
"trust": 0.8,
"vendor": "cobham plc",
"version": "cobham explorer 710 firmware 1.07"
},
{
"model": "explorer 710",
"scope": "lte",
"trust": 0.8,
"vendor": "cobham plc",
"version": "cobham explorer 710 firmware 1.08 and earlier"
},
{
"model": "plc explorer",
"scope": "eq",
"trust": 0.6,
"vendor": "cobham",
"version": "7101.07"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "explorer 710",
"version": "1.07"
}
],
"sources": [
{
"db": "IVD",
"id": "0299e974-5745-47e9-b854-d1fa1a6a0291"
},
{
"db": "CERT/CC",
"id": "VU#719689"
},
{
"db": "CNVD",
"id": "CNVD-2019-35794"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"db": "NVD",
"id": "CVE-2019-9530"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:cobham:explorer_710_firmware:1.07:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:cobham:explorer_710:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2019-9530"
}
]
},
"cve": "CVE-2019-9530",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"impactScore": 6.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:N/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 10.0,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2019-9530",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "CNVD-2019-35794",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "0299e974-5745-47e9-b854-d1fa1a6a0291",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "VHN-160965",
"impactScore": 6.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:L/AC:L/AU:N/C:C/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 9.8,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2019-9530",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2019-9530",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2019-9530",
"trust": 0.8,
"value": "Critical"
},
{
"author": "CNVD",
"id": "CNVD-2019-35794",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201910-703",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "0299e974-5745-47e9-b854-d1fa1a6a0291",
"trust": 0.2,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-160965",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "0299e974-5745-47e9-b854-d1fa1a6a0291"
},
{
"db": "CNVD",
"id": "CNVD-2019-35794"
},
{
"db": "VULHUB",
"id": "VHN-160965"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"db": "CNNVD",
"id": "CNNVD-201910-703"
},
{
"db": "NVD",
"id": "CVE-2019-9530"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The web root directory of the Cobham EXPLORER 710, firmware version 1.07, has no access restrictions on downloading and reading all files. This could allow an unauthenticated, local attacker connected to the device to access and download any file found in the web root directory. CERT/CC researchers examined the satcom terminal Cobham EXPLORER 710 as an expansion of work from IOActive\u2019s findings in 2014. Cobham EXPLORER 710 is a portable satellite communications terminal used for satellite communications and Internet access. Cobham EXPLORER 710 The following multiple vulnerabilities exist in. CVE-2019-9529 Of the product Web The interface does not require authentication in its default state. Therefore, an attacker within the local network can Web The portal may be accessed and settings may be changed. Therefore, arbitrary files may be accessed by an attacker within the local network. CVE-2019-9531 Of the product 5454/tcp without authenticating to the port telnet connection is possible and telnet After connecting, 86 kind of Attention (AT) It is possible to execute commands. CVE-2019-9532 Of the product Web The interface sends the password for login in clear text. Therefore, password information may be stolen by an attacker within the local network. CVE-2019-9533 Firmware of the product v1.08 and all previous versions, the same root A password is used. By analyzing any applicable version of the firmware, an attacker can root It is possible to steal passwords. CVE-2019-9534 This product does not perform firmware image verification. Additionally, a development script left in the firmware allows you to upload and run a custom firmware image. Therefore, attackers within the local network can install tampered firmware, modify or steal communication content, install backdoors, and disrupt service operations. (DoS) Attacks may occur. In addition CERT/CC According to WiFi Because the password is set as HTTP It lacks headers and is also vulnerable to cross-site scripting and clickjacking attacks. These vulnerabilities are 2014 carried out in IOActive \u2019 s findings As a series of studies on CERT/CC newly discovered by researchers.The potential impact will vary for each vulnerability, but you may be affected by: * Leakage or falsification of information - CVE-2019-9529 , CVE-2019-9530 , CVE-2019-9531 , CVE-2019-9532 , CVE-2019-9533 , CVE-2019-9534* Execute arbitrary command - CVE-2019-9531* Service operation interruption (DoS) - CVE-2019-9534",
"sources": [
{
"db": "NVD",
"id": "CVE-2019-9530"
},
{
"db": "CERT/CC",
"id": "VU#719689"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"db": "CNVD",
"id": "CNVD-2019-35794"
},
{
"db": "IVD",
"id": "0299e974-5745-47e9-b854-d1fa1a6a0291"
},
{
"db": "VULHUB",
"id": "VHN-160965"
}
],
"trust": 3.15
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2019-9530",
"trust": 4.1
},
{
"db": "CERT/CC",
"id": "VU#719689",
"trust": 3.3
},
{
"db": "CNVD",
"id": "CNVD-2019-35794",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201910-703",
"trust": 0.8
},
{
"db": "JVN",
"id": "JVNVU98031944",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010367",
"trust": 0.8
},
{
"db": "IVD",
"id": "0299E974-5745-47E9-B854-D1FA1A6A0291",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-160965",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "0299e974-5745-47e9-b854-d1fa1a6a0291"
},
{
"db": "CERT/CC",
"id": "VU#719689"
},
{
"db": "CNVD",
"id": "CNVD-2019-35794"
},
{
"db": "VULHUB",
"id": "VHN-160965"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"db": "CNNVD",
"id": "CNNVD-201910-703"
},
{
"db": "NVD",
"id": "CVE-2019-9530"
}
]
},
"id": "VAR-201910-1692",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "0299e974-5745-47e9-b854-d1fa1a6a0291"
},
{
"db": "CNVD",
"id": "CNVD-2019-35794"
},
{
"db": "VULHUB",
"id": "VHN-160965"
}
],
"trust": 1.9
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"IoT",
"ICS"
],
"sub_category": null,
"trust": 0.6
},
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "0299e974-5745-47e9-b854-d1fa1a6a0291"
},
{
"db": "CNVD",
"id": "CNVD-2019-35794"
}
]
},
"last_update_date": "2024-03-18T22:14:35.032000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Ultra-Portable\u00a0BGAN\u00a0EXPLORER\u00a0710",
"trust": 0.8,
"url": "https://www.cobham.com/communications-and-connectivity/satcom/land-mobile-satcom-systems/ultra-portable-bgan/explorer-710/"
},
{
"title": "Patch for Cobham plc EXPLORER 710 has an unknown vulnerability (CNVD-2019-35794)",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/185635"
},
{
"title": "Cobham plc EXPLORER 710 Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=99313"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-35794"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"db": "CNNVD",
"id": "CNNVD-201910-703"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
},
{
"problemtype": "Lack of authentication for critical features (CWE-306) [NVD evaluation ]",
"trust": 0.8
},
{
"problemtype": " others (CWE-Other) [NVD evaluation ]",
"trust": 0.8
},
{
"problemtype": " Inappropriate authentication (CWE-287) [NVD evaluation ]",
"trust": 0.8
},
{
"problemtype": " Sending important information in clear text (CWE-319) [NVD evaluation ]",
"trust": 0.8
},
{
"problemtype": " Use hard-coded credentials (CWE-798) [NVD evaluation ]",
"trust": 0.8
},
{
"problemtype": " Incomplete integrity verification of downloaded code (CWE-494) [NVD evaluation ]",
"trust": 0.8
},
{
"problemtype": "CWE-200",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-160965"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"db": "NVD",
"id": "CVE-2019-9530"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.0,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-9530"
},
{
"trust": 1.7,
"url": "https://kb.cert.org/vuls/id/719689/"
},
{
"trust": 1.6,
"url": "https://ioactive.com/pdfs/ioactive_satcom_security_whitepaper.pdf"
},
{
"trust": 1.6,
"url": "https://www.owasp.org/index.php/clickjacking"
},
{
"trust": 1.6,
"url": "https://www.owasp.org/index.php/content_security_policy"
},
{
"trust": 0.8,
"url": "https://www.cobham.com/communications-and-connectivity/satcom/land-mobile-satcomsystems/ultra-portable-bgan/explorer-710/"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu98031944/"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-9529"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-9531"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-9532"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-9533"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-9534"
},
{
"trust": 0.8,
"url": "https://www.kb.cert.org/vuls/id/719689/"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#719689"
},
{
"db": "CNVD",
"id": "CNVD-2019-35794"
},
{
"db": "VULHUB",
"id": "VHN-160965"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"db": "CNNVD",
"id": "CNNVD-201910-703"
},
{
"db": "NVD",
"id": "CVE-2019-9530"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "0299e974-5745-47e9-b854-d1fa1a6a0291"
},
{
"db": "CERT/CC",
"id": "VU#719689"
},
{
"db": "CNVD",
"id": "CNVD-2019-35794"
},
{
"db": "VULHUB",
"id": "VHN-160965"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"db": "CNNVD",
"id": "CNNVD-201910-703"
},
{
"db": "NVD",
"id": "CVE-2019-9530"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-10-18T00:00:00",
"db": "IVD",
"id": "0299e974-5745-47e9-b854-d1fa1a6a0291"
},
{
"date": "2019-10-09T00:00:00",
"db": "CERT/CC",
"id": "VU#719689"
},
{
"date": "2019-10-18T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-35794"
},
{
"date": "2019-10-10T00:00:00",
"db": "VULHUB",
"id": "VHN-160965"
},
{
"date": "2019-10-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"date": "2019-10-10T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201910-703"
},
{
"date": "2019-10-10T20:15:11.270000",
"db": "NVD",
"id": "CVE-2019-9530"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-10-11T00:00:00",
"db": "CERT/CC",
"id": "VU#719689"
},
{
"date": "2019-10-18T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-35794"
},
{
"date": "2019-10-16T00:00:00",
"db": "VULHUB",
"id": "VHN-160965"
},
{
"date": "2024-03-05T08:16:00",
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"date": "2021-10-27T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201910-703"
},
{
"date": "2021-10-26T20:17:51.297000",
"db": "NVD",
"id": "CVE-2019-9530"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201910-703"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Multiple vulnerabilities found in the Cobham EXPLORER 710 satcom terminal",
"sources": [
{
"db": "CERT/CC",
"id": "VU#719689"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "other",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201910-703"
}
],
"trust": 0.6
}
}
VAR-201910-0318
Vulnerability from variot - Updated: 2024-03-18 22:14The web application portal of the Cobham EXPLORER 710, firmware version 1.07, sends the login password in cleartext. This could allow an unauthenticated, local attacker to intercept the password and gain access to the portal. CERT/CC researchers examined the satcom terminal Cobham EXPLORER 710 as an expansion of work from IOActive’s findings in 2014. Cobham EXPLORER 710 is a portable satellite communications terminal used for satellite communications and Internet access. Cobham EXPLORER 710 The following multiple vulnerabilities exist in. CVE-2019-9529 Of the product Web The interface does not require authentication in its default state. CVE-2019-9530 There are no access restrictions on the document root directory of the product. Therefore, arbitrary files may be accessed by an attacker within the local network. CVE-2019-9531 Of the product 5454/tcp without authenticating to the port telnet connection is possible and telnet After connecting, 86 kind of Attention (AT) It is possible to execute commands. CVE-2019-9533 Firmware of the product v1.08 and all previous versions, the same root A password is used. By analyzing any applicable version of the firmware, an attacker can root It is possible to steal passwords. CVE-2019-9534 This product does not perform firmware image verification. Additionally, a development script left in the firmware allows you to upload and run a custom firmware image. Therefore, attackers within the local network can install tampered firmware, modify or steal communication content, install backdoors, and disrupt service operations. (DoS) Attacks may occur. In addition CERT/CC According to WiFi Because the password is set as HTTP It lacks headers and is also vulnerable to cross-site scripting and clickjacking attacks. These vulnerabilities are 2014 carried out in IOActive ’ s findings As a series of studies on CERT/CC newly discovered by researchers.The potential impact will vary for each vulnerability, but you may be affected by: * Leakage or falsification of information - CVE-2019-9529 , CVE-2019-9530 , CVE-2019-9531 , CVE-2019-9532 , CVE-2019-9533 , CVE-2019-9534 Execute arbitrary command - CVE-2019-9531 Service operation interruption (DoS) - CVE-2019-9534
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201910-0318",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "explorer 710",
"scope": "eq",
"trust": 1.6,
"vendor": "cobham",
"version": "1.07"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "cobham plc",
"version": null
},
{
"model": "explorer 710",
"scope": "eq",
"trust": 0.8,
"vendor": "cobham plc",
"version": null
},
{
"model": "explorer 710",
"scope": "eq",
"trust": 0.8,
"vendor": "cobham plc",
"version": "cobham explorer 710 firmware 1.07"
},
{
"model": "explorer 710",
"scope": "lte",
"trust": 0.8,
"vendor": "cobham plc",
"version": "cobham explorer 710 firmware 1.08 and earlier"
},
{
"model": "plc explorer",
"scope": "eq",
"trust": 0.6,
"vendor": "cobham",
"version": "7101.07"
},
{
"model": "explorer 710",
"scope": "eq",
"trust": 0.6,
"vendor": "cobham",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "explorer 710",
"version": "1.07"
}
],
"sources": [
{
"db": "IVD",
"id": "ffc2d02a-cc2f-43b4-a4c9-c45ef76a6268"
},
{
"db": "CERT/CC",
"id": "VU#719689"
},
{
"db": "CNVD",
"id": "CNVD-2019-35800"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"db": "CNNVD",
"id": "CNNVD-201910-705"
},
{
"db": "NVD",
"id": "CVE-2019-9532"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:cobham:explorer_710_firmware:1.07:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:cobham:explorer_710:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2019-9532"
}
]
},
"cve": "CVE-2019-9532",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 3.9,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "LOW",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 10.0,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2019-9532",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "CNVD-2019-35800",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "ffc2d02a-cc2f-43b4-a4c9-c45ef76a6268",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.9 [IVD]"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 9.8,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2019-9532",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2019-9532",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2019-9532",
"trust": 0.8,
"value": "Critical"
},
{
"author": "CNVD",
"id": "CNVD-2019-35800",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201910-705",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "IVD",
"id": "ffc2d02a-cc2f-43b4-a4c9-c45ef76a6268",
"trust": 0.2,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "ffc2d02a-cc2f-43b4-a4c9-c45ef76a6268"
},
{
"db": "CNVD",
"id": "CNVD-2019-35800"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"db": "CNNVD",
"id": "CNNVD-201910-705"
},
{
"db": "NVD",
"id": "CVE-2019-9532"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The web application portal of the Cobham EXPLORER 710, firmware version 1.07, sends the login password in cleartext. This could allow an unauthenticated, local attacker to intercept the password and gain access to the portal. CERT/CC researchers examined the satcom terminal Cobham EXPLORER 710 as an expansion of work from IOActive\u2019s findings in 2014. Cobham EXPLORER 710 is a portable satellite communications terminal used for satellite communications and Internet access. Cobham EXPLORER 710 The following multiple vulnerabilities exist in. CVE-2019-9529 Of the product Web The interface does not require authentication in its default state. CVE-2019-9530 There are no access restrictions on the document root directory of the product. Therefore, arbitrary files may be accessed by an attacker within the local network. CVE-2019-9531 Of the product 5454/tcp without authenticating to the port telnet connection is possible and telnet After connecting, 86 kind of Attention (AT) It is possible to execute commands. CVE-2019-9533 Firmware of the product v1.08 and all previous versions, the same root A password is used. By analyzing any applicable version of the firmware, an attacker can root It is possible to steal passwords. CVE-2019-9534 This product does not perform firmware image verification. Additionally, a development script left in the firmware allows you to upload and run a custom firmware image. Therefore, attackers within the local network can install tampered firmware, modify or steal communication content, install backdoors, and disrupt service operations. (DoS) Attacks may occur. In addition CERT/CC According to WiFi Because the password is set as HTTP It lacks headers and is also vulnerable to cross-site scripting and clickjacking attacks. These vulnerabilities are 2014 carried out in IOActive \u2019 s findings As a series of studies on CERT/CC newly discovered by researchers.The potential impact will vary for each vulnerability, but you may be affected by: * Leakage or falsification of information - CVE-2019-9529 , CVE-2019-9530 , CVE-2019-9531 , CVE-2019-9532 , CVE-2019-9533 , CVE-2019-9534* Execute arbitrary command - CVE-2019-9531* Service operation interruption (DoS) - CVE-2019-9534",
"sources": [
{
"db": "NVD",
"id": "CVE-2019-9532"
},
{
"db": "CERT/CC",
"id": "VU#719689"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"db": "CNVD",
"id": "CNVD-2019-35800"
},
{
"db": "IVD",
"id": "ffc2d02a-cc2f-43b4-a4c9-c45ef76a6268"
}
],
"trust": 3.06
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2019-9532",
"trust": 4.0
},
{
"db": "CERT/CC",
"id": "VU#719689",
"trust": 3.2
},
{
"db": "CNVD",
"id": "CNVD-2019-35800",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201910-705",
"trust": 0.8
},
{
"db": "JVN",
"id": "JVNVU98031944",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010367",
"trust": 0.8
},
{
"db": "IVD",
"id": "FFC2D02A-CC2F-43B4-A4C9-C45EF76A6268",
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "ffc2d02a-cc2f-43b4-a4c9-c45ef76a6268"
},
{
"db": "CERT/CC",
"id": "VU#719689"
},
{
"db": "CNVD",
"id": "CNVD-2019-35800"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"db": "CNNVD",
"id": "CNNVD-201910-705"
},
{
"db": "NVD",
"id": "CVE-2019-9532"
}
]
},
"id": "VAR-201910-0318",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "ffc2d02a-cc2f-43b4-a4c9-c45ef76a6268"
},
{
"db": "CNVD",
"id": "CNVD-2019-35800"
}
],
"trust": 1.8
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"IoT",
"ICS"
],
"sub_category": null,
"trust": 0.6
},
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "ffc2d02a-cc2f-43b4-a4c9-c45ef76a6268"
},
{
"db": "CNVD",
"id": "CNVD-2019-35800"
}
]
},
"last_update_date": "2024-03-18T22:14:34.963000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Ultra-Portable\u00a0BGAN\u00a0EXPLORER\u00a0710",
"trust": 0.8,
"url": "https://www.cobham.com/communications-and-connectivity/satcom/land-mobile-satcom-systems/ultra-portable-bgan/explorer-710/"
},
{
"title": "Patch for Cobham plc EXPLORER 710 has an unknown vulnerability (CNVD-2019-35800)",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/185631"
},
{
"title": "Cobham plc EXPLORER 710 Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=99315"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-35800"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"db": "CNNVD",
"id": "CNNVD-201910-705"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-319",
"trust": 1.0
},
{
"problemtype": "Lack of authentication for critical features (CWE-306) [NVD evaluation ]",
"trust": 0.8
},
{
"problemtype": " others (CWE-Other) [NVD evaluation ]",
"trust": 0.8
},
{
"problemtype": " Inappropriate authentication (CWE-287) [NVD evaluation ]",
"trust": 0.8
},
{
"problemtype": " Sending important information in clear text (CWE-319) [NVD evaluation ]",
"trust": 0.8
},
{
"problemtype": " Use hard-coded credentials (CWE-798) [NVD evaluation ]",
"trust": 0.8
},
{
"problemtype": " Incomplete integrity verification of downloaded code (CWE-494) [NVD evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"db": "NVD",
"id": "CVE-2019-9532"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.0,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-9532"
},
{
"trust": 1.6,
"url": "https://ioactive.com/pdfs/ioactive_satcom_security_whitepaper.pdf"
},
{
"trust": 1.6,
"url": "https://www.owasp.org/index.php/clickjacking"
},
{
"trust": 1.6,
"url": "https://www.owasp.org/index.php/content_security_policy"
},
{
"trust": 1.6,
"url": "https://kb.cert.org/vuls/id/719689/"
},
{
"trust": 0.8,
"url": "https://www.cobham.com/communications-and-connectivity/satcom/land-mobile-satcomsystems/ultra-portable-bgan/explorer-710/"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu98031944/"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-9529"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-9530"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-9531"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-9533"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-9534"
},
{
"trust": 0.8,
"url": "https://www.kb.cert.org/vuls/id/719689/"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#719689"
},
{
"db": "CNVD",
"id": "CNVD-2019-35800"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"db": "CNNVD",
"id": "CNNVD-201910-705"
},
{
"db": "NVD",
"id": "CVE-2019-9532"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "ffc2d02a-cc2f-43b4-a4c9-c45ef76a6268"
},
{
"db": "CERT/CC",
"id": "VU#719689"
},
{
"db": "CNVD",
"id": "CNVD-2019-35800"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"db": "CNNVD",
"id": "CNNVD-201910-705"
},
{
"db": "NVD",
"id": "CVE-2019-9532"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-10-18T00:00:00",
"db": "IVD",
"id": "ffc2d02a-cc2f-43b4-a4c9-c45ef76a6268"
},
{
"date": "2019-10-09T00:00:00",
"db": "CERT/CC",
"id": "VU#719689"
},
{
"date": "2019-10-18T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-35800"
},
{
"date": "2019-10-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"date": "2019-10-10T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201910-705"
},
{
"date": "2019-10-10T20:15:11.410000",
"db": "NVD",
"id": "CVE-2019-9532"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-10-11T00:00:00",
"db": "CERT/CC",
"id": "VU#719689"
},
{
"date": "2019-10-18T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-35800"
},
{
"date": "2024-03-05T08:16:00",
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"date": "2019-10-21T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201910-705"
},
{
"date": "2019-10-17T16:31:33.957000",
"db": "NVD",
"id": "CVE-2019-9532"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201910-705"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Multiple vulnerabilities found in the Cobham EXPLORER 710 satcom terminal",
"sources": [
{
"db": "CERT/CC",
"id": "VU#719689"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "other",
"sources": [
{
"db": "IVD",
"id": "ffc2d02a-cc2f-43b4-a4c9-c45ef76a6268"
},
{
"db": "CNNVD",
"id": "CNNVD-201910-705"
}
],
"trust": 0.8
}
}
VAR-201910-0320
Vulnerability from variot - Updated: 2024-03-18 22:14The Cobham EXPLORER 710, firmware version 1.07, does not validate its firmware image. Development scripts left in the firmware can be used to upload a custom firmware image that the device runs. This could allow an unauthenticated, local attacker to upload their own firmware that could be used to intercept or modify traffic, spoof or intercept GPS traffic, exfiltrate private data, hide a backdoor, or cause a denial-of-service. CERT/CC researchers examined the satcom terminal Cobham EXPLORER 710 as an expansion of work from IOActive’s findings in 2014. Cobham EXPLORER 710 is a portable satellite communications terminal used for satellite communications and Internet access. Cobham EXPLORER 710 The following multiple vulnerabilities exist in. CVE-2019-9529 Of the product Web The interface does not require authentication in its default state. Therefore, an attacker within the local network can Web The portal may be accessed and settings may be changed. CVE-2019-9530 There are no access restrictions on the document root directory of the product. Therefore, arbitrary files may be accessed by an attacker within the local network. CVE-2019-9531 Of the product 5454/tcp without authenticating to the port telnet connection is possible and telnet After connecting, 86 kind of Attention (AT) It is possible to execute commands. This could allow a remote attacker to access the device and execute these commands. CVE-2019-9532 Of the product Web The interface sends the password for login in clear text. Therefore, password information may be stolen by an attacker within the local network. CVE-2019-9533 Firmware of the product v1.08 and all previous versions, the same root A password is used. By analyzing any applicable version of the firmware, an attacker can root It is possible to steal passwords. Therefore, attackers within the local network can install tampered firmware, modify or steal communication content, install backdoors, and disrupt service operations. (DoS) Attacks may occur. In addition CERT/CC According to WiFi Because the password is set as HTTP It lacks headers and is also vulnerable to cross-site scripting and clickjacking attacks. These vulnerabilities are 2014 carried out in IOActive ’ s findings As a series of studies on CERT/CC newly discovered by researchers.The potential impact will vary for each vulnerability, but you may be affected by: * Leakage or falsification of information - CVE-2019-9529 , CVE-2019-9530 , CVE-2019-9531 , CVE-2019-9532 , CVE-2019-9533 , CVE-2019-9534 Execute arbitrary command - CVE-2019-9531 Service operation interruption (DoS) - CVE-2019-9534
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201910-0320",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "explorer 710",
"scope": "eq",
"trust": 1.6,
"vendor": "cobham",
"version": "1.07"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "cobham plc",
"version": null
},
{
"model": "explorer 710",
"scope": "eq",
"trust": 0.8,
"vendor": "cobham plc",
"version": null
},
{
"model": "explorer 710",
"scope": "eq",
"trust": 0.8,
"vendor": "cobham plc",
"version": "cobham explorer 710 firmware 1.07"
},
{
"model": "explorer 710",
"scope": "lte",
"trust": 0.8,
"vendor": "cobham plc",
"version": "cobham explorer 710 firmware 1.08 and earlier"
},
{
"model": "plc explorer",
"scope": "eq",
"trust": 0.6,
"vendor": "cobham",
"version": "7101.07"
},
{
"model": "explorer 710",
"scope": "eq",
"trust": 0.6,
"vendor": "cobham",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "explorer 710",
"version": "1.07"
}
],
"sources": [
{
"db": "IVD",
"id": "b37781a8-ae4e-42c7-a32d-28e5f88be4e6"
},
{
"db": "CERT/CC",
"id": "VU#719689"
},
{
"db": "CNVD",
"id": "CNVD-2019-35798"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"db": "CNNVD",
"id": "CNNVD-201910-707"
},
{
"db": "NVD",
"id": "CVE-2019-9534"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:cobham:explorer_710_firmware:1.07:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:cobham:explorer_710:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2019-9534"
}
]
},
"cve": "CVE-2019-9534",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 10.0,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2019-9534",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "CNVD-2019-35798",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "b37781a8-ae4e-42c7-a32d-28e5f88be4e6",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.9 [IVD]"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 9.8,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2019-9534",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2019-9534",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2019-9534",
"trust": 0.8,
"value": "Critical"
},
{
"author": "CNVD",
"id": "CNVD-2019-35798",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201910-707",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "IVD",
"id": "b37781a8-ae4e-42c7-a32d-28e5f88be4e6",
"trust": 0.2,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "b37781a8-ae4e-42c7-a32d-28e5f88be4e6"
},
{
"db": "CNVD",
"id": "CNVD-2019-35798"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"db": "CNNVD",
"id": "CNNVD-201910-707"
},
{
"db": "NVD",
"id": "CVE-2019-9534"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The Cobham EXPLORER 710, firmware version 1.07, does not validate its firmware image. Development scripts left in the firmware can be used to upload a custom firmware image that the device runs. This could allow an unauthenticated, local attacker to upload their own firmware that could be used to intercept or modify traffic, spoof or intercept GPS traffic, exfiltrate private data, hide a backdoor, or cause a denial-of-service. CERT/CC researchers examined the satcom terminal Cobham EXPLORER 710 as an expansion of work from IOActive\u2019s findings in 2014. Cobham EXPLORER 710 is a portable satellite communications terminal used for satellite communications and Internet access. Cobham EXPLORER 710 The following multiple vulnerabilities exist in. CVE-2019-9529 Of the product Web The interface does not require authentication in its default state. Therefore, an attacker within the local network can Web The portal may be accessed and settings may be changed. CVE-2019-9530 There are no access restrictions on the document root directory of the product. Therefore, arbitrary files may be accessed by an attacker within the local network. CVE-2019-9531 Of the product 5454/tcp without authenticating to the port telnet connection is possible and telnet After connecting, 86 kind of Attention (AT) It is possible to execute commands. This could allow a remote attacker to access the device and execute these commands. CVE-2019-9532 Of the product Web The interface sends the password for login in clear text. Therefore, password information may be stolen by an attacker within the local network. CVE-2019-9533 Firmware of the product v1.08 and all previous versions, the same root A password is used. By analyzing any applicable version of the firmware, an attacker can root It is possible to steal passwords. Therefore, attackers within the local network can install tampered firmware, modify or steal communication content, install backdoors, and disrupt service operations. (DoS) Attacks may occur. In addition CERT/CC According to WiFi Because the password is set as HTTP It lacks headers and is also vulnerable to cross-site scripting and clickjacking attacks. These vulnerabilities are 2014 carried out in IOActive \u2019 s findings As a series of studies on CERT/CC newly discovered by researchers.The potential impact will vary for each vulnerability, but you may be affected by: * Leakage or falsification of information - CVE-2019-9529 , CVE-2019-9530 , CVE-2019-9531 , CVE-2019-9532 , CVE-2019-9533 , CVE-2019-9534* Execute arbitrary command - CVE-2019-9531* Service operation interruption (DoS) - CVE-2019-9534",
"sources": [
{
"db": "NVD",
"id": "CVE-2019-9534"
},
{
"db": "CERT/CC",
"id": "VU#719689"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"db": "CNVD",
"id": "CNVD-2019-35798"
},
{
"db": "IVD",
"id": "b37781a8-ae4e-42c7-a32d-28e5f88be4e6"
}
],
"trust": 3.06
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2019-9534",
"trust": 4.0
},
{
"db": "CERT/CC",
"id": "VU#719689",
"trust": 3.2
},
{
"db": "CNVD",
"id": "CNVD-2019-35798",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201910-707",
"trust": 0.8
},
{
"db": "JVN",
"id": "JVNVU98031944",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010367",
"trust": 0.8
},
{
"db": "IVD",
"id": "B37781A8-AE4E-42C7-A32D-28E5F88BE4E6",
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "b37781a8-ae4e-42c7-a32d-28e5f88be4e6"
},
{
"db": "CERT/CC",
"id": "VU#719689"
},
{
"db": "CNVD",
"id": "CNVD-2019-35798"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"db": "CNNVD",
"id": "CNNVD-201910-707"
},
{
"db": "NVD",
"id": "CVE-2019-9534"
}
]
},
"id": "VAR-201910-0320",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "b37781a8-ae4e-42c7-a32d-28e5f88be4e6"
},
{
"db": "CNVD",
"id": "CNVD-2019-35798"
}
],
"trust": 1.8
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"IoT",
"ICS"
],
"sub_category": null,
"trust": 0.6
},
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "b37781a8-ae4e-42c7-a32d-28e5f88be4e6"
},
{
"db": "CNVD",
"id": "CNVD-2019-35798"
}
]
},
"last_update_date": "2024-03-18T22:14:34.893000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Ultra-Portable\u00a0BGAN\u00a0EXPLORER\u00a0710",
"trust": 0.8,
"url": "https://www.cobham.com/communications-and-connectivity/satcom/land-mobile-satcom-systems/ultra-portable-bgan/explorer-710/"
},
{
"title": "Patch for Cobham plc EXPLORER 710 has an unknown vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/185627"
},
{
"title": "Cobham plc EXPLORER 710 Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=99317"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-35798"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"db": "CNNVD",
"id": "CNNVD-201910-707"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-494",
"trust": 1.0
},
{
"problemtype": "Lack of authentication for critical features (CWE-306) [NVD evaluation ]",
"trust": 0.8
},
{
"problemtype": " others (CWE-Other) [NVD evaluation ]",
"trust": 0.8
},
{
"problemtype": " Inappropriate authentication (CWE-287) [NVD evaluation ]",
"trust": 0.8
},
{
"problemtype": " Sending important information in clear text (CWE-319) [NVD evaluation ]",
"trust": 0.8
},
{
"problemtype": " Use hard-coded credentials (CWE-798) [NVD evaluation ]",
"trust": 0.8
},
{
"problemtype": " Incomplete integrity verification of downloaded code (CWE-494) [NVD evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"db": "NVD",
"id": "CVE-2019-9534"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.0,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-9534"
},
{
"trust": 1.6,
"url": "https://ioactive.com/pdfs/ioactive_satcom_security_whitepaper.pdf"
},
{
"trust": 1.6,
"url": "https://www.owasp.org/index.php/clickjacking"
},
{
"trust": 1.6,
"url": "https://www.owasp.org/index.php/content_security_policy"
},
{
"trust": 1.6,
"url": "https://kb.cert.org/vuls/id/719689/"
},
{
"trust": 0.8,
"url": "https://www.cobham.com/communications-and-connectivity/satcom/land-mobile-satcomsystems/ultra-portable-bgan/explorer-710/"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu98031944/"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-9529"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-9530"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-9531"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-9532"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-9533"
},
{
"trust": 0.8,
"url": "https://www.kb.cert.org/vuls/id/719689/"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#719689"
},
{
"db": "CNVD",
"id": "CNVD-2019-35798"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"db": "CNNVD",
"id": "CNNVD-201910-707"
},
{
"db": "NVD",
"id": "CVE-2019-9534"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "b37781a8-ae4e-42c7-a32d-28e5f88be4e6"
},
{
"db": "CERT/CC",
"id": "VU#719689"
},
{
"db": "CNVD",
"id": "CNVD-2019-35798"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"db": "CNNVD",
"id": "CNNVD-201910-707"
},
{
"db": "NVD",
"id": "CVE-2019-9534"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-10-18T00:00:00",
"db": "IVD",
"id": "b37781a8-ae4e-42c7-a32d-28e5f88be4e6"
},
{
"date": "2019-10-09T00:00:00",
"db": "CERT/CC",
"id": "VU#719689"
},
{
"date": "2019-10-18T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-35798"
},
{
"date": "2019-10-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"date": "2019-10-10T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201910-707"
},
{
"date": "2019-10-10T20:15:11.537000",
"db": "NVD",
"id": "CVE-2019-9534"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-10-11T00:00:00",
"db": "CERT/CC",
"id": "VU#719689"
},
{
"date": "2019-10-18T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-35798"
},
{
"date": "2024-03-05T08:16:00",
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"date": "2019-10-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201910-707"
},
{
"date": "2024-02-15T21:20:26.287000",
"db": "NVD",
"id": "CVE-2019-9534"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201910-707"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Multiple vulnerabilities found in the Cobham EXPLORER 710 satcom terminal",
"sources": [
{
"db": "CERT/CC",
"id": "VU#719689"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Code problem",
"sources": [
{
"db": "IVD",
"id": "b37781a8-ae4e-42c7-a32d-28e5f88be4e6"
},
{
"db": "CNNVD",
"id": "CNNVD-201910-707"
}
],
"trust": 0.8
}
}
VAR-201910-0316
Vulnerability from variot - Updated: 2024-03-18 22:14The web application portal of the Cobham EXPLORER 710, firmware version 1.07, has no authentication by default. This could allow an unauthenticated, local attacker connected to the device to access the portal and to make any change to the device. CERT/CC researchers examined the satcom terminal Cobham EXPLORER 710 as an expansion of work from IOActive’s findings in 2014. Cobham EXPLORER 710 is a portable satellite communications terminal used for satellite communications and Internet access. Cobham EXPLORER 710 The following multiple vulnerabilities exist in. CVE-2019-9530 There are no access restrictions on the document root directory of the product. Therefore, arbitrary files may be accessed by an attacker within the local network. CVE-2019-9531 Of the product 5454/tcp without authenticating to the port telnet connection is possible and telnet After connecting, 86 kind of Attention (AT) It is possible to execute commands. CVE-2019-9532 Of the product Web The interface sends the password for login in clear text. Therefore, password information may be stolen by an attacker within the local network. CVE-2019-9533 Firmware of the product v1.08 and all previous versions, the same root A password is used. By analyzing any applicable version of the firmware, an attacker can root It is possible to steal passwords. CVE-2019-9534 This product does not perform firmware image verification. Additionally, a development script left in the firmware allows you to upload and run a custom firmware image. Therefore, attackers within the local network can install tampered firmware, modify or steal communication content, install backdoors, and disrupt service operations. (DoS) Attacks may occur. In addition CERT/CC According to WiFi Because the password is set as HTTP It lacks headers and is also vulnerable to cross-site scripting and clickjacking attacks. These vulnerabilities are 2014 carried out in IOActive ’ s findings As a series of studies on CERT/CC newly discovered by researchers.The potential impact will vary for each vulnerability, but you may be affected by: * Leakage or falsification of information - CVE-2019-9529 , CVE-2019-9530 , CVE-2019-9531 , CVE-2019-9532 , CVE-2019-9533 , CVE-2019-9534 Execute arbitrary command - CVE-2019-9531 Service operation interruption (DoS) - CVE-2019-9534
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201910-0316",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "explorer 710",
"scope": "eq",
"trust": 1.6,
"vendor": "cobham",
"version": "1.07"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "cobham plc",
"version": null
},
{
"model": "explorer 710",
"scope": "eq",
"trust": 0.8,
"vendor": "cobham plc",
"version": null
},
{
"model": "explorer 710",
"scope": "eq",
"trust": 0.8,
"vendor": "cobham plc",
"version": "cobham explorer 710 firmware 1.07"
},
{
"model": "explorer 710",
"scope": "lte",
"trust": 0.8,
"vendor": "cobham plc",
"version": "cobham explorer 710 firmware 1.08 and earlier"
},
{
"model": "plc explorer",
"scope": "eq",
"trust": 0.6,
"vendor": "cobham",
"version": "7101.07"
},
{
"model": "explorer 710",
"scope": "eq",
"trust": 0.6,
"vendor": "cobham",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "explorer 710",
"version": "1.07"
}
],
"sources": [
{
"db": "IVD",
"id": "82aebd54-6b37-4700-91c2-0a6170c7658f"
},
{
"db": "CERT/CC",
"id": "VU#719689"
},
{
"db": "CNVD",
"id": "CNVD-2019-35795"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"db": "CNNVD",
"id": "CNNVD-201910-702"
},
{
"db": "NVD",
"id": "CVE-2019-9529"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:cobham:explorer_710_firmware:1.07:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:cobham:explorer_710:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2019-9529"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "This document was written by Kyle O\u0027Meara and David Belasco of the CERT Coordination Center of the Carnegie Mellon Software Engineering Institute.",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201910-702"
}
],
"trust": 0.6
},
"cve": "CVE-2019-9529",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.9,
"impactScore": 6.9,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:L/AC:L/Au:N/C:N/I:C/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 10.0,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2019-9529",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "CNVD-2019-35795",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "82aebd54-6b37-4700-91c2-0a6170c7658f",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.9 [IVD]"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"exploitabilityScore": 1.8,
"impactScore": 3.6,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 9.8,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2019-9529",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2019-9529",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2019-9529",
"trust": 0.8,
"value": "Critical"
},
{
"author": "CNVD",
"id": "CNVD-2019-35795",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201910-702",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "82aebd54-6b37-4700-91c2-0a6170c7658f",
"trust": 0.2,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "82aebd54-6b37-4700-91c2-0a6170c7658f"
},
{
"db": "CNVD",
"id": "CNVD-2019-35795"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"db": "CNNVD",
"id": "CNNVD-201910-702"
},
{
"db": "NVD",
"id": "CVE-2019-9529"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The web application portal of the Cobham EXPLORER 710, firmware version 1.07, has no authentication by default. This could allow an unauthenticated, local attacker connected to the device to access the portal and to make any change to the device. CERT/CC researchers examined the satcom terminal Cobham EXPLORER 710 as an expansion of work from IOActive\u2019s findings in 2014. Cobham EXPLORER 710 is a portable satellite communications terminal used for satellite communications and Internet access. Cobham EXPLORER 710 The following multiple vulnerabilities exist in. CVE-2019-9530 There are no access restrictions on the document root directory of the product. Therefore, arbitrary files may be accessed by an attacker within the local network. CVE-2019-9531 Of the product 5454/tcp without authenticating to the port telnet connection is possible and telnet After connecting, 86 kind of Attention (AT) It is possible to execute commands. CVE-2019-9532 Of the product Web The interface sends the password for login in clear text. Therefore, password information may be stolen by an attacker within the local network. CVE-2019-9533 Firmware of the product v1.08 and all previous versions, the same root A password is used. By analyzing any applicable version of the firmware, an attacker can root It is possible to steal passwords. CVE-2019-9534 This product does not perform firmware image verification. Additionally, a development script left in the firmware allows you to upload and run a custom firmware image. Therefore, attackers within the local network can install tampered firmware, modify or steal communication content, install backdoors, and disrupt service operations. (DoS) Attacks may occur. In addition CERT/CC According to WiFi Because the password is set as HTTP It lacks headers and is also vulnerable to cross-site scripting and clickjacking attacks. These vulnerabilities are 2014 carried out in IOActive \u2019 s findings As a series of studies on CERT/CC newly discovered by researchers.The potential impact will vary for each vulnerability, but you may be affected by: * Leakage or falsification of information - CVE-2019-9529 , CVE-2019-9530 , CVE-2019-9531 , CVE-2019-9532 , CVE-2019-9533 , CVE-2019-9534* Execute arbitrary command - CVE-2019-9531* Service operation interruption (DoS) - CVE-2019-9534",
"sources": [
{
"db": "NVD",
"id": "CVE-2019-9529"
},
{
"db": "CERT/CC",
"id": "VU#719689"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"db": "CNVD",
"id": "CNVD-2019-35795"
},
{
"db": "IVD",
"id": "82aebd54-6b37-4700-91c2-0a6170c7658f"
}
],
"trust": 3.06
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2019-9529",
"trust": 4.0
},
{
"db": "CERT/CC",
"id": "VU#719689",
"trust": 3.2
},
{
"db": "CNVD",
"id": "CNVD-2019-35795",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201910-702",
"trust": 0.8
},
{
"db": "JVN",
"id": "JVNVU98031944",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010367",
"trust": 0.8
},
{
"db": "IVD",
"id": "82AEBD54-6B37-4700-91C2-0A6170C7658F",
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "82aebd54-6b37-4700-91c2-0a6170c7658f"
},
{
"db": "CERT/CC",
"id": "VU#719689"
},
{
"db": "CNVD",
"id": "CNVD-2019-35795"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"db": "CNNVD",
"id": "CNNVD-201910-702"
},
{
"db": "NVD",
"id": "CVE-2019-9529"
}
]
},
"id": "VAR-201910-0316",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "82aebd54-6b37-4700-91c2-0a6170c7658f"
},
{
"db": "CNVD",
"id": "CNVD-2019-35795"
}
],
"trust": 1.8
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"IoT",
"ICS"
],
"sub_category": null,
"trust": 0.6
},
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "82aebd54-6b37-4700-91c2-0a6170c7658f"
},
{
"db": "CNVD",
"id": "CNVD-2019-35795"
}
]
},
"last_update_date": "2024-03-18T22:14:34.859000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Ultra-Portable\u00a0BGAN\u00a0EXPLORER\u00a0710",
"trust": 0.8,
"url": "https://www.cobham.com/communications-and-connectivity/satcom/land-mobile-satcom-systems/ultra-portable-bgan/explorer-710/"
},
{
"title": "Patch for Cobham plc EXPLORER 710 has an unknown vulnerability (CNVD-2019-35795)",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/185637"
},
{
"title": "Cobham plc EXPLORER 710 Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=99312"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-35795"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"db": "CNNVD",
"id": "CNNVD-201910-702"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-306",
"trust": 1.0
},
{
"problemtype": "Lack of authentication for critical features (CWE-306) [NVD evaluation ]",
"trust": 0.8
},
{
"problemtype": " others (CWE-Other) [NVD evaluation ]",
"trust": 0.8
},
{
"problemtype": " Inappropriate authentication (CWE-287) [NVD evaluation ]",
"trust": 0.8
},
{
"problemtype": " Sending important information in clear text (CWE-319) [NVD evaluation ]",
"trust": 0.8
},
{
"problemtype": " Use hard-coded credentials (CWE-798) [NVD evaluation ]",
"trust": 0.8
},
{
"problemtype": " Incomplete integrity verification of downloaded code (CWE-494) [NVD evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"db": "NVD",
"id": "CVE-2019-9529"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.2,
"url": "https://ioactive.com/pdfs/ioactive_satcom_security_whitepaper.pdf"
},
{
"trust": 2.2,
"url": "https://www.owasp.org/index.php/clickjacking"
},
{
"trust": 2.2,
"url": "https://www.owasp.org/index.php/content_security_policy"
},
{
"trust": 2.0,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-9529"
},
{
"trust": 1.6,
"url": "https://kb.cert.org/vuls/id/719689/"
},
{
"trust": 1.4,
"url": "https://www.cobham.com/communications-and-connectivity/satcom/land-mobile-satcomsystems/ultra-portable-bgan/explorer-710/"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu98031944/"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-9530"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-9531"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-9532"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-9533"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-9534"
},
{
"trust": 0.8,
"url": "https://www.kb.cert.org/vuls/id/719689/"
},
{
"trust": 0.6,
"url": "https://www.kb.cert.org/vuls/id/719689"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#719689"
},
{
"db": "CNVD",
"id": "CNVD-2019-35795"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"db": "CNNVD",
"id": "CNNVD-201910-702"
},
{
"db": "NVD",
"id": "CVE-2019-9529"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "82aebd54-6b37-4700-91c2-0a6170c7658f"
},
{
"db": "CERT/CC",
"id": "VU#719689"
},
{
"db": "CNVD",
"id": "CNVD-2019-35795"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"db": "CNNVD",
"id": "CNNVD-201910-702"
},
{
"db": "NVD",
"id": "CVE-2019-9529"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-10-18T00:00:00",
"db": "IVD",
"id": "82aebd54-6b37-4700-91c2-0a6170c7658f"
},
{
"date": "2019-10-09T00:00:00",
"db": "CERT/CC",
"id": "VU#719689"
},
{
"date": "2019-10-18T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-35795"
},
{
"date": "2019-10-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"date": "2019-10-10T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201910-702"
},
{
"date": "2019-10-10T20:15:11.207000",
"db": "NVD",
"id": "CVE-2019-9529"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-10-11T00:00:00",
"db": "CERT/CC",
"id": "VU#719689"
},
{
"date": "2019-10-18T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-35795"
},
{
"date": "2024-03-05T08:16:00",
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"date": "2019-12-27T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201910-702"
},
{
"date": "2019-10-21T15:57:29.600000",
"db": "NVD",
"id": "CVE-2019-9529"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201910-702"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Multiple vulnerabilities found in the Cobham EXPLORER 710 satcom terminal",
"sources": [
{
"db": "CERT/CC",
"id": "VU#719689"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Access control error",
"sources": [
{
"db": "IVD",
"id": "82aebd54-6b37-4700-91c2-0a6170c7658f"
},
{
"db": "CNNVD",
"id": "CNNVD-201910-702"
}
],
"trust": 0.8
}
}
VAR-201910-0317
Vulnerability from variot - Updated: 2024-03-18 22:14The web application portal of the Cobham EXPLORER 710, firmware version 1.07, allows unauthenticated access to port 5454. This could allow an unauthenticated, remote attacker to connect to this port via Telnet and execute 86 Attention (AT) commands, including some that provide unauthenticated, shell-like access to the device. CERT/CC researchers examined the satcom terminal Cobham EXPLORER 710 as an expansion of work from IOActive’s findings in 2014. Cobham EXPLORER 710 is a portable satellite communications terminal used for satellite communications and Internet access. Cobham EXPLORER 710 The following multiple vulnerabilities exist in. CVE-2019-9529 Of the product Web The interface does not require authentication in its default state. Therefore, an attacker within the local network can Web The portal may be accessed and settings may be changed. CVE-2019-9530 There are no access restrictions on the document root directory of the product. Therefore, arbitrary files may be accessed by an attacker within the local network. CVE-2019-9532 Of the product Web The interface sends the password for login in clear text. Therefore, password information may be stolen by an attacker within the local network. CVE-2019-9533 Firmware of the product v1.08 and all previous versions, the same root A password is used. By analyzing any applicable version of the firmware, an attacker can root It is possible to steal passwords. CVE-2019-9534 This product does not perform firmware image verification. Additionally, a development script left in the firmware allows you to upload and run a custom firmware image. Therefore, attackers within the local network can install tampered firmware, modify or steal communication content, install backdoors, and disrupt service operations. (DoS) Attacks may occur. In addition CERT/CC According to WiFi Because the password is set as HTTP It lacks headers and is also vulnerable to cross-site scripting and clickjacking attacks. These vulnerabilities are 2014 carried out in IOActive ’ s findings As a series of studies on CERT/CC newly discovered by researchers.The potential impact will vary for each vulnerability, but you may be affected by: * Leakage or falsification of information - CVE-2019-9529 , CVE-2019-9530 , CVE-2019-9531 , CVE-2019-9532 , CVE-2019-9533 , CVE-2019-9534 Execute arbitrary command - CVE-2019-9531 Service operation interruption (DoS) - CVE-2019-9534
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201910-0317",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "explorer 710",
"scope": "eq",
"trust": 1.6,
"vendor": "cobham",
"version": "1.07"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "cobham plc",
"version": null
},
{
"model": "explorer 710",
"scope": "eq",
"trust": 0.8,
"vendor": "cobham plc",
"version": null
},
{
"model": "explorer 710",
"scope": "eq",
"trust": 0.8,
"vendor": "cobham plc",
"version": "cobham explorer 710 firmware 1.07"
},
{
"model": "explorer 710",
"scope": "lte",
"trust": 0.8,
"vendor": "cobham plc",
"version": "cobham explorer 710 firmware 1.08 and earlier"
},
{
"model": "plc explorer",
"scope": "eq",
"trust": 0.6,
"vendor": "cobham",
"version": "7101.07"
},
{
"model": "explorer 710",
"scope": "eq",
"trust": 0.6,
"vendor": "cobham",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "explorer 710",
"version": "1.07"
}
],
"sources": [
{
"db": "IVD",
"id": "749ad358-983d-4df2-aba6-cd92baa86f78"
},
{
"db": "CERT/CC",
"id": "VU#719689"
},
{
"db": "CNVD",
"id": "CNVD-2019-35793"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"db": "CNNVD",
"id": "CNNVD-201910-704"
},
{
"db": "NVD",
"id": "CVE-2019-9531"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:cobham:explorer_710_firmware:1.07:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:cobham:explorer_710:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2019-9531"
}
]
},
"cve": "CVE-2019-9531",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 10.0,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2019-9531",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "CNVD-2019-35793",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "749ad358-983d-4df2-aba6-cd92baa86f78",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.9 [IVD]"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 9.8,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2019-9531",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2019-9531",
"trust": 1.8,
"value": "CRITICAL"
},
{
"author": "CNVD",
"id": "CNVD-2019-35793",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201910-704",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "IVD",
"id": "749ad358-983d-4df2-aba6-cd92baa86f78",
"trust": 0.2,
"value": "CRITICAL"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "749ad358-983d-4df2-aba6-cd92baa86f78"
},
{
"db": "CNVD",
"id": "CNVD-2019-35793"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"db": "CNNVD",
"id": "CNNVD-201910-704"
},
{
"db": "NVD",
"id": "CVE-2019-9531"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The web application portal of the Cobham EXPLORER 710, firmware version 1.07, allows unauthenticated access to port 5454. This could allow an unauthenticated, remote attacker to connect to this port via Telnet and execute 86 Attention (AT) commands, including some that provide unauthenticated, shell-like access to the device. CERT/CC researchers examined the satcom terminal Cobham EXPLORER 710 as an expansion of work from IOActive\u2019s findings in 2014. Cobham EXPLORER 710 is a portable satellite communications terminal used for satellite communications and Internet access. Cobham EXPLORER 710 The following multiple vulnerabilities exist in. CVE-2019-9529 Of the product Web The interface does not require authentication in its default state. Therefore, an attacker within the local network can Web The portal may be accessed and settings may be changed. CVE-2019-9530 There are no access restrictions on the document root directory of the product. Therefore, arbitrary files may be accessed by an attacker within the local network. CVE-2019-9532 Of the product Web The interface sends the password for login in clear text. Therefore, password information may be stolen by an attacker within the local network. CVE-2019-9533 Firmware of the product v1.08 and all previous versions, the same root A password is used. By analyzing any applicable version of the firmware, an attacker can root It is possible to steal passwords. CVE-2019-9534 This product does not perform firmware image verification. Additionally, a development script left in the firmware allows you to upload and run a custom firmware image. Therefore, attackers within the local network can install tampered firmware, modify or steal communication content, install backdoors, and disrupt service operations. (DoS) Attacks may occur. In addition CERT/CC According to WiFi Because the password is set as HTTP It lacks headers and is also vulnerable to cross-site scripting and clickjacking attacks. These vulnerabilities are 2014 carried out in IOActive \u2019 s findings As a series of studies on CERT/CC newly discovered by researchers.The potential impact will vary for each vulnerability, but you may be affected by: * Leakage or falsification of information - CVE-2019-9529 , CVE-2019-9530 , CVE-2019-9531 , CVE-2019-9532 , CVE-2019-9533 , CVE-2019-9534* Execute arbitrary command - CVE-2019-9531* Service operation interruption (DoS) - CVE-2019-9534",
"sources": [
{
"db": "NVD",
"id": "CVE-2019-9531"
},
{
"db": "CERT/CC",
"id": "VU#719689"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"db": "CNVD",
"id": "CNVD-2019-35793"
},
{
"db": "IVD",
"id": "749ad358-983d-4df2-aba6-cd92baa86f78"
}
],
"trust": 3.06
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2019-9531",
"trust": 4.0
},
{
"db": "CERT/CC",
"id": "VU#719689",
"trust": 3.2
},
{
"db": "CNVD",
"id": "CNVD-2019-35793",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201910-704",
"trust": 0.8
},
{
"db": "JVN",
"id": "JVNVU98031944",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010367",
"trust": 0.8
},
{
"db": "IVD",
"id": "749AD358-983D-4DF2-ABA6-CD92BAA86F78",
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "749ad358-983d-4df2-aba6-cd92baa86f78"
},
{
"db": "CERT/CC",
"id": "VU#719689"
},
{
"db": "CNVD",
"id": "CNVD-2019-35793"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"db": "CNNVD",
"id": "CNNVD-201910-704"
},
{
"db": "NVD",
"id": "CVE-2019-9531"
}
]
},
"id": "VAR-201910-0317",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "749ad358-983d-4df2-aba6-cd92baa86f78"
},
{
"db": "CNVD",
"id": "CNVD-2019-35793"
}
],
"trust": 1.8
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"IoT",
"ICS"
],
"sub_category": null,
"trust": 0.6
},
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "749ad358-983d-4df2-aba6-cd92baa86f78"
},
{
"db": "CNVD",
"id": "CNVD-2019-35793"
}
]
},
"last_update_date": "2024-03-18T22:14:34.995000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Ultra-Portable\u00a0BGAN\u00a0EXPLORER\u00a0710",
"trust": 0.8,
"url": "https://www.cobham.com/communications-and-connectivity/satcom/land-mobile-satcom-systems/ultra-portable-bgan/explorer-710/"
},
{
"title": "Patch for Cobham plc EXPLORER 710 has an unknown vulnerability (CNVD-2019-35793)",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/185633"
},
{
"title": "Cobham plc EXPLORER 710 Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=99314"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-35793"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"db": "CNNVD",
"id": "CNNVD-201910-704"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-287",
"trust": 1.0
},
{
"problemtype": "Lack of authentication for critical features (CWE-306) [NVD evaluation ]",
"trust": 0.8
},
{
"problemtype": " others (CWE-Other) [NVD evaluation ]",
"trust": 0.8
},
{
"problemtype": " Inappropriate authentication (CWE-287) [NVD evaluation ]",
"trust": 0.8
},
{
"problemtype": " Sending important information in clear text (CWE-319) [NVD evaluation ]",
"trust": 0.8
},
{
"problemtype": " Use hard-coded credentials (CWE-798) [NVD evaluation ]",
"trust": 0.8
},
{
"problemtype": " Incomplete integrity verification of downloaded code (CWE-494) [NVD evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"db": "NVD",
"id": "CVE-2019-9531"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.0,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-9531"
},
{
"trust": 1.6,
"url": "https://ioactive.com/pdfs/ioactive_satcom_security_whitepaper.pdf"
},
{
"trust": 1.6,
"url": "https://www.owasp.org/index.php/clickjacking"
},
{
"trust": 1.6,
"url": "https://www.owasp.org/index.php/content_security_policy"
},
{
"trust": 1.6,
"url": "https://kb.cert.org/vuls/id/719689/"
},
{
"trust": 0.8,
"url": "https://www.cobham.com/communications-and-connectivity/satcom/land-mobile-satcomsystems/ultra-portable-bgan/explorer-710/"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu98031944/"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-9529"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-9530"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-9532"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-9533"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-9534"
},
{
"trust": 0.8,
"url": "https://www.kb.cert.org/vuls/id/719689/"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#719689"
},
{
"db": "CNVD",
"id": "CNVD-2019-35793"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"db": "CNNVD",
"id": "CNNVD-201910-704"
},
{
"db": "NVD",
"id": "CVE-2019-9531"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "749ad358-983d-4df2-aba6-cd92baa86f78"
},
{
"db": "CERT/CC",
"id": "VU#719689"
},
{
"db": "CNVD",
"id": "CNVD-2019-35793"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"db": "CNNVD",
"id": "CNNVD-201910-704"
},
{
"db": "NVD",
"id": "CVE-2019-9531"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-10-18T00:00:00",
"db": "IVD",
"id": "749ad358-983d-4df2-aba6-cd92baa86f78"
},
{
"date": "2019-10-09T00:00:00",
"db": "CERT/CC",
"id": "VU#719689"
},
{
"date": "2019-10-18T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-35793"
},
{
"date": "2019-10-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"date": "2019-10-10T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201910-704"
},
{
"date": "2019-10-10T20:15:11.333000",
"db": "NVD",
"id": "CVE-2019-9531"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-10-11T00:00:00",
"db": "CERT/CC",
"id": "VU#719689"
},
{
"date": "2019-10-18T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-35793"
},
{
"date": "2024-03-05T08:16:00",
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"date": "2019-11-05T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201910-704"
},
{
"date": "2019-10-17T16:42:57.753000",
"db": "NVD",
"id": "CVE-2019-9531"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201910-704"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Multiple vulnerabilities found in the Cobham EXPLORER 710 satcom terminal",
"sources": [
{
"db": "CERT/CC",
"id": "VU#719689"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "authorization issue",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201910-704"
}
],
"trust": 0.6
}
}
VAR-201910-0319
Vulnerability from variot - Updated: 2024-03-18 22:14The root password of the Cobham EXPLORER 710 is the same for all versions of firmware up to and including v1.08. This could allow an attacker to reverse-engineer the password from available versions to gain authenticated access to the device. CERT/CC researchers examined the satcom terminal Cobham EXPLORER 710 as an expansion of work from IOActive’s findings in 2014. Cobham EXPLORER 710 is a portable satellite communications terminal used for satellite communications and Internet access. Cobham EXPLORER 710 The following multiple vulnerabilities exist in. CVE-2019-9529 Of the product Web The interface does not require authentication in its default state. Therefore, an attacker within the local network can Web The portal may be accessed and settings may be changed. CVE-2019-9530 There are no access restrictions on the document root directory of the product. Therefore, arbitrary files may be accessed by an attacker within the local network. CVE-2019-9531 Of the product 5454/tcp without authenticating to the port telnet connection is possible and telnet After connecting, 86 kind of Attention (AT) It is possible to execute commands. CVE-2019-9532 Of the product Web The interface sends the password for login in clear text. Therefore, password information may be stolen by an attacker within the local network. CVE-2019-9534 This product does not perform firmware image verification. Additionally, a development script left in the firmware allows you to upload and run a custom firmware image. Therefore, attackers within the local network can install tampered firmware, modify or steal communication content, install backdoors, and disrupt service operations. (DoS) Attacks may occur. In addition CERT/CC According to WiFi Because the password is set as HTTP It lacks headers and is also vulnerable to cross-site scripting and clickjacking attacks. These vulnerabilities are 2014 carried out in IOActive ’ s findings As a series of studies on CERT/CC newly discovered by researchers.The potential impact will vary for each vulnerability, but you may be affected by: * Leakage or falsification of information - CVE-2019-9529 , CVE-2019-9530 , CVE-2019-9531 , CVE-2019-9532 , CVE-2019-9533 , CVE-2019-9534 Execute arbitrary command - CVE-2019-9531 Service operation interruption (DoS) - CVE-2019-9534
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201910-0319",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "explorer 710",
"scope": "eq",
"trust": 1.0,
"vendor": "cobham",
"version": "1.07"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "cobham plc",
"version": null
},
{
"model": "explorer 710",
"scope": "eq",
"trust": 0.8,
"vendor": "cobham plc",
"version": null
},
{
"model": "explorer 710",
"scope": "eq",
"trust": 0.8,
"vendor": "cobham plc",
"version": "cobham explorer 710 firmware 1.07"
},
{
"model": "explorer 710",
"scope": "lte",
"trust": 0.8,
"vendor": "cobham plc",
"version": "cobham explorer 710 firmware 1.08 and earlier"
},
{
"model": "plc explorer",
"scope": "eq",
"trust": 0.6,
"vendor": "cobham",
"version": "710\u003c=1.08"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "explorer 710",
"version": "1.07"
}
],
"sources": [
{
"db": "IVD",
"id": "a79ea90c-0749-4875-94ff-d1671c89a10f"
},
{
"db": "CERT/CC",
"id": "VU#719689"
},
{
"db": "CNVD",
"id": "CNVD-2019-35799"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"db": "NVD",
"id": "CVE-2019-9533"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:cobham:explorer_710_firmware:1.07:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:cobham:explorer_710:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2019-9533"
}
]
},
"cve": "CVE-2019-9533",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 10.0,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2019-9533",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "CNVD-2019-35799",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "a79ea90c-0749-4875-94ff-d1671c89a10f",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.9 [IVD]"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 9.8,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2019-9533",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2019-9533",
"trust": 1.8,
"value": "CRITICAL"
},
{
"author": "CNVD",
"id": "CNVD-2019-35799",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201910-706",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "IVD",
"id": "a79ea90c-0749-4875-94ff-d1671c89a10f",
"trust": 0.2,
"value": "CRITICAL"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "a79ea90c-0749-4875-94ff-d1671c89a10f"
},
{
"db": "CNVD",
"id": "CNVD-2019-35799"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"db": "CNNVD",
"id": "CNNVD-201910-706"
},
{
"db": "NVD",
"id": "CVE-2019-9533"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The root password of the Cobham EXPLORER 710 is the same for all versions of firmware up to and including v1.08. This could allow an attacker to reverse-engineer the password from available versions to gain authenticated access to the device. CERT/CC researchers examined the satcom terminal Cobham EXPLORER 710 as an expansion of work from IOActive\u2019s findings in 2014. Cobham EXPLORER 710 is a portable satellite communications terminal used for satellite communications and Internet access. Cobham EXPLORER 710 The following multiple vulnerabilities exist in. CVE-2019-9529 Of the product Web The interface does not require authentication in its default state. Therefore, an attacker within the local network can Web The portal may be accessed and settings may be changed. CVE-2019-9530 There are no access restrictions on the document root directory of the product. Therefore, arbitrary files may be accessed by an attacker within the local network. CVE-2019-9531 Of the product 5454/tcp without authenticating to the port telnet connection is possible and telnet After connecting, 86 kind of Attention (AT) It is possible to execute commands. CVE-2019-9532 Of the product Web The interface sends the password for login in clear text. Therefore, password information may be stolen by an attacker within the local network. CVE-2019-9534 This product does not perform firmware image verification. Additionally, a development script left in the firmware allows you to upload and run a custom firmware image. Therefore, attackers within the local network can install tampered firmware, modify or steal communication content, install backdoors, and disrupt service operations. (DoS) Attacks may occur. In addition CERT/CC According to WiFi Because the password is set as HTTP It lacks headers and is also vulnerable to cross-site scripting and clickjacking attacks. These vulnerabilities are 2014 carried out in IOActive \u2019 s findings As a series of studies on CERT/CC newly discovered by researchers.The potential impact will vary for each vulnerability, but you may be affected by: * Leakage or falsification of information - CVE-2019-9529 , CVE-2019-9530 , CVE-2019-9531 , CVE-2019-9532 , CVE-2019-9533 , CVE-2019-9534* Execute arbitrary command - CVE-2019-9531* Service operation interruption (DoS) - CVE-2019-9534",
"sources": [
{
"db": "NVD",
"id": "CVE-2019-9533"
},
{
"db": "CERT/CC",
"id": "VU#719689"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"db": "CNVD",
"id": "CNVD-2019-35799"
},
{
"db": "IVD",
"id": "a79ea90c-0749-4875-94ff-d1671c89a10f"
}
],
"trust": 3.06
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2019-9533",
"trust": 4.0
},
{
"db": "CERT/CC",
"id": "VU#719689",
"trust": 3.2
},
{
"db": "CNVD",
"id": "CNVD-2019-35799",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201910-706",
"trust": 0.8
},
{
"db": "JVN",
"id": "JVNVU98031944",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010367",
"trust": 0.8
},
{
"db": "IVD",
"id": "A79EA90C-0749-4875-94FF-D1671C89A10F",
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "a79ea90c-0749-4875-94ff-d1671c89a10f"
},
{
"db": "CERT/CC",
"id": "VU#719689"
},
{
"db": "CNVD",
"id": "CNVD-2019-35799"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"db": "CNNVD",
"id": "CNNVD-201910-706"
},
{
"db": "NVD",
"id": "CVE-2019-9533"
}
]
},
"id": "VAR-201910-0319",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "a79ea90c-0749-4875-94ff-d1671c89a10f"
},
{
"db": "CNVD",
"id": "CNVD-2019-35799"
}
],
"trust": 1.8
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"IoT",
"ICS"
],
"sub_category": null,
"trust": 0.6
},
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "a79ea90c-0749-4875-94ff-d1671c89a10f"
},
{
"db": "CNVD",
"id": "CNVD-2019-35799"
}
]
},
"last_update_date": "2024-03-18T22:14:34.930000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Ultra-Portable\u00a0BGAN\u00a0EXPLORER\u00a0710",
"trust": 0.8,
"url": "https://www.cobham.com/communications-and-connectivity/satcom/land-mobile-satcom-systems/ultra-portable-bgan/explorer-710/"
},
{
"title": "Patch for Cobham plc EXPLORER 710 has an unknown vulnerability (CNVD-2019-35799)",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/185629"
},
{
"title": "Cobham plc EXPLORER 710 Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=99316"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-35799"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"db": "CNNVD",
"id": "CNNVD-201910-706"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-798",
"trust": 1.0
},
{
"problemtype": "Lack of authentication for critical features (CWE-306) [NVD evaluation ]",
"trust": 0.8
},
{
"problemtype": " others (CWE-Other) [NVD evaluation ]",
"trust": 0.8
},
{
"problemtype": " Inappropriate authentication (CWE-287) [NVD evaluation ]",
"trust": 0.8
},
{
"problemtype": " Sending important information in clear text (CWE-319) [NVD evaluation ]",
"trust": 0.8
},
{
"problemtype": " Use hard-coded credentials (CWE-798) [NVD evaluation ]",
"trust": 0.8
},
{
"problemtype": " Incomplete integrity verification of downloaded code (CWE-494) [NVD evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"db": "NVD",
"id": "CVE-2019-9533"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.0,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-9533"
},
{
"trust": 1.6,
"url": "https://ioactive.com/pdfs/ioactive_satcom_security_whitepaper.pdf"
},
{
"trust": 1.6,
"url": "https://www.owasp.org/index.php/clickjacking"
},
{
"trust": 1.6,
"url": "https://www.owasp.org/index.php/content_security_policy"
},
{
"trust": 1.6,
"url": "https://kb.cert.org/vuls/id/719689/"
},
{
"trust": 0.8,
"url": "https://www.cobham.com/communications-and-connectivity/satcom/land-mobile-satcomsystems/ultra-portable-bgan/explorer-710/"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu98031944/"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-9529"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-9530"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-9531"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-9532"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-9534"
},
{
"trust": 0.8,
"url": "https://www.kb.cert.org/vuls/id/719689/"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#719689"
},
{
"db": "CNVD",
"id": "CNVD-2019-35799"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"db": "CNNVD",
"id": "CNNVD-201910-706"
},
{
"db": "NVD",
"id": "CVE-2019-9533"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "a79ea90c-0749-4875-94ff-d1671c89a10f"
},
{
"db": "CERT/CC",
"id": "VU#719689"
},
{
"db": "CNVD",
"id": "CNVD-2019-35799"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"db": "CNNVD",
"id": "CNNVD-201910-706"
},
{
"db": "NVD",
"id": "CVE-2019-9533"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-10-18T00:00:00",
"db": "IVD",
"id": "a79ea90c-0749-4875-94ff-d1671c89a10f"
},
{
"date": "2019-10-09T00:00:00",
"db": "CERT/CC",
"id": "VU#719689"
},
{
"date": "2019-10-18T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-35799"
},
{
"date": "2019-10-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"date": "2019-10-10T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201910-706"
},
{
"date": "2019-10-10T20:15:11.473000",
"db": "NVD",
"id": "CVE-2019-9533"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-10-11T00:00:00",
"db": "CERT/CC",
"id": "VU#719689"
},
{
"date": "2019-10-18T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-35799"
},
{
"date": "2024-03-05T08:16:00",
"db": "JVNDB",
"id": "JVNDB-2019-010367"
},
{
"date": "2020-10-21T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201910-706"
},
{
"date": "2020-10-16T13:15:56.613000",
"db": "NVD",
"id": "CVE-2019-9533"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201910-706"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Multiple vulnerabilities found in the Cobham EXPLORER 710 satcom terminal",
"sources": [
{
"db": "CERT/CC",
"id": "VU#719689"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "trust management problem",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201910-706"
}
],
"trust": 0.6
}
}
CVE-2019-9530 (GCVE-0-2019-9530)
Vulnerability from cvelistv5 – Published: 2019-10-10 20:09 – Updated: 2024-09-16 17:14
VLAI?
Title
The web root directory of the Cobham EXPLORER 710, firmware version 1.07, has no access restrictions on downloading and reading all files
Summary
The web root directory of the Cobham EXPLORER 710, firmware version 1.07, has no access restrictions on downloading and reading all files. This could allow an unauthenticated, local attacker connected to the device to access and download any file found in the web root directory.
Severity ?
No CVSS data available.
CWE
- CWE-284 - Improper Access Control
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cobham plc | Explorer 710 |
Affected:
1.07
|
Credits
This issue was found by Kyle O'Meara and David Belasco.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T21:54:44.562Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "VU#719689",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "https://kb.cert.org/vuls/id/719689/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Explorer 710",
"vendor": "Cobham plc",
"versions": [
{
"status": "affected",
"version": "1.07"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This issue was found by Kyle O\u0027Meara and David Belasco."
}
],
"datePublic": "2019-10-09T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The web root directory of the Cobham EXPLORER 710, firmware version 1.07, has no access restrictions on downloading and reading all files. This could allow an unauthenticated, local attacker connected to the device to access and download any file found in the web root directory."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-10-10T20:09:47",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"name": "VU#719689",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "https://kb.cert.org/vuls/id/719689/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "The web root directory of the Cobham EXPLORER 710, firmware version 1.07, has no access restrictions on downloading and reading all files",
"x_generator": {
"engine": "Vulnogram 0.0.8"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cert@cert.org",
"DATE_PUBLIC": "2019-10-09T04:00:00.000Z",
"ID": "CVE-2019-9530",
"STATE": "PUBLIC",
"TITLE": "The web root directory of the Cobham EXPLORER 710, firmware version 1.07, has no access restrictions on downloading and reading all files"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Explorer 710",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.07",
"version_value": "1.07"
}
]
}
}
]
},
"vendor_name": "Cobham plc"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "This issue was found by Kyle O\u0027Meara and David Belasco."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The web root directory of the Cobham EXPLORER 710, firmware version 1.07, has no access restrictions on downloading and reading all files. This could allow an unauthenticated, local attacker connected to the device to access and download any file found in the web root directory."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.8"
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-284 Improper Access Control"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "VU#719689",
"refsource": "CERT-VN",
"url": "https://kb.cert.org/vuls/id/719689/"
}
]
},
"source": {
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2019-9530",
"datePublished": "2019-10-10T20:09:47.669417Z",
"dateReserved": "2019-03-01T00:00:00",
"dateUpdated": "2024-09-16T17:14:11.909Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-9529 (GCVE-0-2019-9529)
Vulnerability from cvelistv5 – Published: 2019-10-10 20:09 – Updated: 2024-09-16 20:07
VLAI?
Title
The web application portal of the Cobham EXPLORER 710, firmware version 1.07, has no authentication by default
Summary
The web application portal of the Cobham EXPLORER 710, firmware version 1.07, has no authentication by default. This could allow an unauthenticated, local attacker connected to the device to access the portal and to make any change to the device.
Severity ?
No CVSS data available.
CWE
- CWE-284 - Improper Access Control
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cobham plc | Explorer 710 |
Affected:
1.07
|
Credits
This issue was found by Kyle O'Meara and David Belasco.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T21:54:44.511Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "VU#719689",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "https://kb.cert.org/vuls/id/719689/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Explorer 710",
"vendor": "Cobham plc",
"versions": [
{
"status": "affected",
"version": "1.07"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This issue was found by Kyle O\u0027Meara and David Belasco."
}
],
"datePublic": "2019-10-09T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The web application portal of the Cobham EXPLORER 710, firmware version 1.07, has no authentication by default. This could allow an unauthenticated, local attacker connected to the device to access the portal and to make any change to the device."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-10-10T20:09:47",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"name": "VU#719689",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "https://kb.cert.org/vuls/id/719689/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "The web application portal of the Cobham EXPLORER 710, firmware version 1.07, has no authentication by default",
"x_generator": {
"engine": "Vulnogram 0.0.8"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cert@cert.org",
"DATE_PUBLIC": "2019-10-09T04:00:00.000Z",
"ID": "CVE-2019-9529",
"STATE": "PUBLIC",
"TITLE": "The web application portal of the Cobham EXPLORER 710, firmware version 1.07, has no authentication by default"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Explorer 710",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.07",
"version_value": "1.07"
}
]
}
}
]
},
"vendor_name": "Cobham plc"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "This issue was found by Kyle O\u0027Meara and David Belasco."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The web application portal of the Cobham EXPLORER 710, firmware version 1.07, has no authentication by default. This could allow an unauthenticated, local attacker connected to the device to access the portal and to make any change to the device."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.8"
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-284 Improper Access Control"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "VU#719689",
"refsource": "CERT-VN",
"url": "https://kb.cert.org/vuls/id/719689/"
}
]
},
"source": {
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2019-9529",
"datePublished": "2019-10-10T20:09:47.632608Z",
"dateReserved": "2019-03-01T00:00:00",
"dateUpdated": "2024-09-16T20:07:10.559Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-9532 (GCVE-0-2019-9532)
Vulnerability from cvelistv5 – Published: 2019-10-10 20:09 – Updated: 2024-09-16 19:30
VLAI?
Title
The web application portal of the Cobham EXPLORER 710, firmware version 1.07, sends the login password in cleartext
Summary
The web application portal of the Cobham EXPLORER 710, firmware version 1.07, sends the login password in cleartext. This could allow an unauthenticated, local attacker to intercept the password and gain access to the portal.
Severity ?
No CVSS data available.
CWE
- CWE-319 - Cleartext Transmission of Sensitive Information
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cobham plc | Explorer 710 |
Affected:
1.07
|
Credits
This issue was found by Kyle O'Meara and David Belasco.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T21:54:44.525Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "VU#719689",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "https://kb.cert.org/vuls/id/719689/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Explorer 710",
"vendor": "Cobham plc",
"versions": [
{
"status": "affected",
"version": "1.07"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This issue was found by Kyle O\u0027Meara and David Belasco."
}
],
"datePublic": "2019-10-09T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The web application portal of the Cobham EXPLORER 710, firmware version 1.07, sends the login password in cleartext. This could allow an unauthenticated, local attacker to intercept the password and gain access to the portal."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-319",
"description": "CWE-319: Cleartext Transmission of Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-10-10T20:09:47",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"name": "VU#719689",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "https://kb.cert.org/vuls/id/719689/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "The web application portal of the Cobham EXPLORER 710, firmware version 1.07, sends the login password in cleartext",
"x_generator": {
"engine": "Vulnogram 0.0.8"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cert@cert.org",
"DATE_PUBLIC": "2019-10-09T04:00:00.000Z",
"ID": "CVE-2019-9532",
"STATE": "PUBLIC",
"TITLE": "The web application portal of the Cobham EXPLORER 710, firmware version 1.07, sends the login password in cleartext"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Explorer 710",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.07",
"version_value": "1.07"
}
]
}
}
]
},
"vendor_name": "Cobham plc"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "This issue was found by Kyle O\u0027Meara and David Belasco."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The web application portal of the Cobham EXPLORER 710, firmware version 1.07, sends the login password in cleartext. This could allow an unauthenticated, local attacker to intercept the password and gain access to the portal."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.8"
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-319: Cleartext Transmission of Sensitive Information"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "VU#719689",
"refsource": "CERT-VN",
"url": "https://kb.cert.org/vuls/id/719689/"
}
]
},
"source": {
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2019-9532",
"datePublished": "2019-10-10T20:09:47.739617Z",
"dateReserved": "2019-03-01T00:00:00",
"dateUpdated": "2024-09-16T19:30:16.862Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-9531 (GCVE-0-2019-9531)
Vulnerability from cvelistv5 – Published: 2019-10-10 20:09 – Updated: 2024-09-16 20:02
VLAI?
Title
The web application portal of the Cobham EXPLORER 710, firmware version 1.07, allows unauthenticated access to a port that can run AT commands
Summary
The web application portal of the Cobham EXPLORER 710, firmware version 1.07, allows unauthenticated access to port 5454. This could allow an unauthenticated, remote attacker to connect to this port via Telnet and execute 86 Attention (AT) commands, including some that provide unauthenticated, shell-like access to the device.
Severity ?
No CVSS data available.
CWE
- CWE-284 - Improper Access Control
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cobham plc | Explorer 710 |
Affected:
1.07
|
Credits
This issue was found by Kyle O'Meara and David Belasco.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T21:54:44.584Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "VU#719689",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "https://kb.cert.org/vuls/id/719689/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Explorer 710",
"vendor": "Cobham plc",
"versions": [
{
"status": "affected",
"version": "1.07"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This issue was found by Kyle O\u0027Meara and David Belasco."
}
],
"datePublic": "2019-10-09T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The web application portal of the Cobham EXPLORER 710, firmware version 1.07, allows unauthenticated access to port 5454. This could allow an unauthenticated, remote attacker to connect to this port via Telnet and execute 86 Attention (AT) commands, including some that provide unauthenticated, shell-like access to the device."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-10-10T20:09:47",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"name": "VU#719689",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "https://kb.cert.org/vuls/id/719689/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "The web application portal of the Cobham EXPLORER 710, firmware version 1.07, allows unauthenticated access to a port that can run AT commands",
"x_generator": {
"engine": "Vulnogram 0.0.8"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cert@cert.org",
"DATE_PUBLIC": "2019-10-09T04:00:00.000Z",
"ID": "CVE-2019-9531",
"STATE": "PUBLIC",
"TITLE": "The web application portal of the Cobham EXPLORER 710, firmware version 1.07, allows unauthenticated access to a port that can run AT commands"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Explorer 710",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.07",
"version_value": "1.07"
}
]
}
}
]
},
"vendor_name": "Cobham plc"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "This issue was found by Kyle O\u0027Meara and David Belasco."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The web application portal of the Cobham EXPLORER 710, firmware version 1.07, allows unauthenticated access to port 5454. This could allow an unauthenticated, remote attacker to connect to this port via Telnet and execute 86 Attention (AT) commands, including some that provide unauthenticated, shell-like access to the device."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.8"
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-284 Improper Access Control"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "VU#719689",
"refsource": "CERT-VN",
"url": "https://kb.cert.org/vuls/id/719689/"
}
]
},
"source": {
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2019-9531",
"datePublished": "2019-10-10T20:09:47.705125Z",
"dateReserved": "2019-03-01T00:00:00",
"dateUpdated": "2024-09-16T20:02:16.560Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-9534 (GCVE-0-2019-9534)
Vulnerability from cvelistv5 – Published: 2019-10-10 20:09 – Updated: 2024-09-17 00:15
VLAI?
Title
The Cobham EXPLORER 710, firmware version 1.07, does not validate its firmware image
Summary
The Cobham EXPLORER 710, firmware version 1.07, does not validate its firmware image. Development scripts left in the firmware can be used to upload a custom firmware image that the device runs. This could allow an unauthenticated, local attacker to upload their own firmware that could be used to intercept or modify traffic, spoof or intercept GPS traffic, exfiltrate private data, hide a backdoor, or cause a denial-of-service.
Severity ?
No CVSS data available.
CWE
- CWE-494 - Download of Code Without Integrity Check
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cobham plc | Explorer 710 |
Affected:
1.07
|
Credits
This issue was found by Kyle O'Meara and David Belasco.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T21:54:44.413Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "VU#719689",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "https://kb.cert.org/vuls/id/719689/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Explorer 710",
"vendor": "Cobham plc",
"versions": [
{
"status": "affected",
"version": "1.07"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This issue was found by Kyle O\u0027Meara and David Belasco."
}
],
"datePublic": "2019-10-09T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The Cobham EXPLORER 710, firmware version 1.07, does not validate its firmware image. Development scripts left in the firmware can be used to upload a custom firmware image that the device runs. This could allow an unauthenticated, local attacker to upload their own firmware that could be used to intercept or modify traffic, spoof or intercept GPS traffic, exfiltrate private data, hide a backdoor, or cause a denial-of-service."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-494",
"description": "CWE-494 Download of Code Without Integrity Check",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-10-10T20:09:47",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"name": "VU#719689",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "https://kb.cert.org/vuls/id/719689/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "The Cobham EXPLORER 710, firmware version 1.07, does not validate its firmware image",
"x_generator": {
"engine": "Vulnogram 0.0.8"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cert@cert.org",
"DATE_PUBLIC": "2019-10-09T04:00:00.000Z",
"ID": "CVE-2019-9534",
"STATE": "PUBLIC",
"TITLE": "The Cobham EXPLORER 710, firmware version 1.07, does not validate its firmware image"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Explorer 710",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.07",
"version_value": "1.07"
}
]
}
}
]
},
"vendor_name": "Cobham plc"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "This issue was found by Kyle O\u0027Meara and David Belasco."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Cobham EXPLORER 710, firmware version 1.07, does not validate its firmware image. Development scripts left in the firmware can be used to upload a custom firmware image that the device runs. This could allow an unauthenticated, local attacker to upload their own firmware that could be used to intercept or modify traffic, spoof or intercept GPS traffic, exfiltrate private data, hide a backdoor, or cause a denial-of-service."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.8"
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-494 Download of Code Without Integrity Check"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "VU#719689",
"refsource": "CERT-VN",
"url": "https://kb.cert.org/vuls/id/719689/"
}
]
},
"source": {
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2019-9534",
"datePublished": "2019-10-10T20:09:47.814464Z",
"dateReserved": "2019-03-01T00:00:00",
"dateUpdated": "2024-09-17T00:15:54.409Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-9533 (GCVE-0-2019-9533)
Vulnerability from cvelistv5 – Published: 2019-10-10 20:09 – Updated: 2024-09-16 16:28
VLAI?
Title
The root password of the Cobham EXPLORER 710 is the same for all versions of firmware up to and including v1.08
Summary
The root password of the Cobham EXPLORER 710 is the same for all versions of firmware up to and including v1.08. This could allow an attacker to reverse-engineer the password from available versions to gain authenticated access to the device.
Severity ?
No CVSS data available.
CWE
- CWE-522 - Insufficiently Protected Credentials
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cobham plc | Explorer 710 |
Affected:
1.08 , ≤ 1.08
(custom)
|
Credits
This issue was found by Kyle O'Meara and David Belasco.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T21:54:44.145Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "VU#719689",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "https://kb.cert.org/vuls/id/719689/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Explorer 710",
"vendor": "Cobham plc",
"versions": [
{
"lessThanOrEqual": "1.08",
"status": "affected",
"version": "1.08",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This issue was found by Kyle O\u0027Meara and David Belasco."
}
],
"datePublic": "2019-10-09T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The root password of the Cobham EXPLORER 710 is the same for all versions of firmware up to and including v1.08. This could allow an attacker to reverse-engineer the password from available versions to gain authenticated access to the device."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "CWE-522: Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-10-10T20:09:47",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"name": "VU#719689",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "https://kb.cert.org/vuls/id/719689/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "The root password of the Cobham EXPLORER 710 is the same for all versions of firmware up to and including v1.08",
"x_generator": {
"engine": "Vulnogram 0.0.8"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cert@cert.org",
"DATE_PUBLIC": "2019-10-09T04:00:00.000Z",
"ID": "CVE-2019-9533",
"STATE": "PUBLIC",
"TITLE": "The root password of the Cobham EXPLORER 710 is the same for all versions of firmware up to and including v1.08"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Explorer 710",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "1.08",
"version_value": "1.08"
}
]
}
}
]
},
"vendor_name": "Cobham plc"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "This issue was found by Kyle O\u0027Meara and David Belasco."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The root password of the Cobham EXPLORER 710 is the same for all versions of firmware up to and including v1.08. This could allow an attacker to reverse-engineer the password from available versions to gain authenticated access to the device."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.8"
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-522: Insufficiently Protected Credentials"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "VU#719689",
"refsource": "CERT-VN",
"url": "https://kb.cert.org/vuls/id/719689/"
}
]
},
"source": {
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2019-9533",
"datePublished": "2019-10-10T20:09:47.781734Z",
"dateReserved": "2019-03-01T00:00:00",
"dateUpdated": "2024-09-16T16:28:25.213Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-9530 (GCVE-0-2019-9530)
Vulnerability from nvd – Published: 2019-10-10 20:09 – Updated: 2024-09-16 17:14
VLAI?
Title
The web root directory of the Cobham EXPLORER 710, firmware version 1.07, has no access restrictions on downloading and reading all files
Summary
The web root directory of the Cobham EXPLORER 710, firmware version 1.07, has no access restrictions on downloading and reading all files. This could allow an unauthenticated, local attacker connected to the device to access and download any file found in the web root directory.
Severity ?
No CVSS data available.
CWE
- CWE-284 - Improper Access Control
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cobham plc | Explorer 710 |
Affected:
1.07
|
Credits
This issue was found by Kyle O'Meara and David Belasco.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T21:54:44.562Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "VU#719689",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "https://kb.cert.org/vuls/id/719689/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Explorer 710",
"vendor": "Cobham plc",
"versions": [
{
"status": "affected",
"version": "1.07"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This issue was found by Kyle O\u0027Meara and David Belasco."
}
],
"datePublic": "2019-10-09T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The web root directory of the Cobham EXPLORER 710, firmware version 1.07, has no access restrictions on downloading and reading all files. This could allow an unauthenticated, local attacker connected to the device to access and download any file found in the web root directory."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-10-10T20:09:47",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"name": "VU#719689",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "https://kb.cert.org/vuls/id/719689/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "The web root directory of the Cobham EXPLORER 710, firmware version 1.07, has no access restrictions on downloading and reading all files",
"x_generator": {
"engine": "Vulnogram 0.0.8"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cert@cert.org",
"DATE_PUBLIC": "2019-10-09T04:00:00.000Z",
"ID": "CVE-2019-9530",
"STATE": "PUBLIC",
"TITLE": "The web root directory of the Cobham EXPLORER 710, firmware version 1.07, has no access restrictions on downloading and reading all files"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Explorer 710",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.07",
"version_value": "1.07"
}
]
}
}
]
},
"vendor_name": "Cobham plc"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "This issue was found by Kyle O\u0027Meara and David Belasco."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The web root directory of the Cobham EXPLORER 710, firmware version 1.07, has no access restrictions on downloading and reading all files. This could allow an unauthenticated, local attacker connected to the device to access and download any file found in the web root directory."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.8"
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-284 Improper Access Control"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "VU#719689",
"refsource": "CERT-VN",
"url": "https://kb.cert.org/vuls/id/719689/"
}
]
},
"source": {
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2019-9530",
"datePublished": "2019-10-10T20:09:47.669417Z",
"dateReserved": "2019-03-01T00:00:00",
"dateUpdated": "2024-09-16T17:14:11.909Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-9529 (GCVE-0-2019-9529)
Vulnerability from nvd – Published: 2019-10-10 20:09 – Updated: 2024-09-16 20:07
VLAI?
Title
The web application portal of the Cobham EXPLORER 710, firmware version 1.07, has no authentication by default
Summary
The web application portal of the Cobham EXPLORER 710, firmware version 1.07, has no authentication by default. This could allow an unauthenticated, local attacker connected to the device to access the portal and to make any change to the device.
Severity ?
No CVSS data available.
CWE
- CWE-284 - Improper Access Control
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cobham plc | Explorer 710 |
Affected:
1.07
|
Credits
This issue was found by Kyle O'Meara and David Belasco.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T21:54:44.511Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "VU#719689",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "https://kb.cert.org/vuls/id/719689/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Explorer 710",
"vendor": "Cobham plc",
"versions": [
{
"status": "affected",
"version": "1.07"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This issue was found by Kyle O\u0027Meara and David Belasco."
}
],
"datePublic": "2019-10-09T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The web application portal of the Cobham EXPLORER 710, firmware version 1.07, has no authentication by default. This could allow an unauthenticated, local attacker connected to the device to access the portal and to make any change to the device."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-10-10T20:09:47",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"name": "VU#719689",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "https://kb.cert.org/vuls/id/719689/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "The web application portal of the Cobham EXPLORER 710, firmware version 1.07, has no authentication by default",
"x_generator": {
"engine": "Vulnogram 0.0.8"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cert@cert.org",
"DATE_PUBLIC": "2019-10-09T04:00:00.000Z",
"ID": "CVE-2019-9529",
"STATE": "PUBLIC",
"TITLE": "The web application portal of the Cobham EXPLORER 710, firmware version 1.07, has no authentication by default"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Explorer 710",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.07",
"version_value": "1.07"
}
]
}
}
]
},
"vendor_name": "Cobham plc"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "This issue was found by Kyle O\u0027Meara and David Belasco."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The web application portal of the Cobham EXPLORER 710, firmware version 1.07, has no authentication by default. This could allow an unauthenticated, local attacker connected to the device to access the portal and to make any change to the device."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.8"
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-284 Improper Access Control"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "VU#719689",
"refsource": "CERT-VN",
"url": "https://kb.cert.org/vuls/id/719689/"
}
]
},
"source": {
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2019-9529",
"datePublished": "2019-10-10T20:09:47.632608Z",
"dateReserved": "2019-03-01T00:00:00",
"dateUpdated": "2024-09-16T20:07:10.559Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-9532 (GCVE-0-2019-9532)
Vulnerability from nvd – Published: 2019-10-10 20:09 – Updated: 2024-09-16 19:30
VLAI?
Title
The web application portal of the Cobham EXPLORER 710, firmware version 1.07, sends the login password in cleartext
Summary
The web application portal of the Cobham EXPLORER 710, firmware version 1.07, sends the login password in cleartext. This could allow an unauthenticated, local attacker to intercept the password and gain access to the portal.
Severity ?
No CVSS data available.
CWE
- CWE-319 - Cleartext Transmission of Sensitive Information
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cobham plc | Explorer 710 |
Affected:
1.07
|
Credits
This issue was found by Kyle O'Meara and David Belasco.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T21:54:44.525Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "VU#719689",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "https://kb.cert.org/vuls/id/719689/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Explorer 710",
"vendor": "Cobham plc",
"versions": [
{
"status": "affected",
"version": "1.07"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This issue was found by Kyle O\u0027Meara and David Belasco."
}
],
"datePublic": "2019-10-09T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The web application portal of the Cobham EXPLORER 710, firmware version 1.07, sends the login password in cleartext. This could allow an unauthenticated, local attacker to intercept the password and gain access to the portal."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-319",
"description": "CWE-319: Cleartext Transmission of Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-10-10T20:09:47",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"name": "VU#719689",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "https://kb.cert.org/vuls/id/719689/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "The web application portal of the Cobham EXPLORER 710, firmware version 1.07, sends the login password in cleartext",
"x_generator": {
"engine": "Vulnogram 0.0.8"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cert@cert.org",
"DATE_PUBLIC": "2019-10-09T04:00:00.000Z",
"ID": "CVE-2019-9532",
"STATE": "PUBLIC",
"TITLE": "The web application portal of the Cobham EXPLORER 710, firmware version 1.07, sends the login password in cleartext"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Explorer 710",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.07",
"version_value": "1.07"
}
]
}
}
]
},
"vendor_name": "Cobham plc"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "This issue was found by Kyle O\u0027Meara and David Belasco."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The web application portal of the Cobham EXPLORER 710, firmware version 1.07, sends the login password in cleartext. This could allow an unauthenticated, local attacker to intercept the password and gain access to the portal."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.8"
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-319: Cleartext Transmission of Sensitive Information"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "VU#719689",
"refsource": "CERT-VN",
"url": "https://kb.cert.org/vuls/id/719689/"
}
]
},
"source": {
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2019-9532",
"datePublished": "2019-10-10T20:09:47.739617Z",
"dateReserved": "2019-03-01T00:00:00",
"dateUpdated": "2024-09-16T19:30:16.862Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-9531 (GCVE-0-2019-9531)
Vulnerability from nvd – Published: 2019-10-10 20:09 – Updated: 2024-09-16 20:02
VLAI?
Title
The web application portal of the Cobham EXPLORER 710, firmware version 1.07, allows unauthenticated access to a port that can run AT commands
Summary
The web application portal of the Cobham EXPLORER 710, firmware version 1.07, allows unauthenticated access to port 5454. This could allow an unauthenticated, remote attacker to connect to this port via Telnet and execute 86 Attention (AT) commands, including some that provide unauthenticated, shell-like access to the device.
Severity ?
No CVSS data available.
CWE
- CWE-284 - Improper Access Control
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cobham plc | Explorer 710 |
Affected:
1.07
|
Credits
This issue was found by Kyle O'Meara and David Belasco.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T21:54:44.584Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "VU#719689",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "https://kb.cert.org/vuls/id/719689/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Explorer 710",
"vendor": "Cobham plc",
"versions": [
{
"status": "affected",
"version": "1.07"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This issue was found by Kyle O\u0027Meara and David Belasco."
}
],
"datePublic": "2019-10-09T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The web application portal of the Cobham EXPLORER 710, firmware version 1.07, allows unauthenticated access to port 5454. This could allow an unauthenticated, remote attacker to connect to this port via Telnet and execute 86 Attention (AT) commands, including some that provide unauthenticated, shell-like access to the device."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-10-10T20:09:47",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"name": "VU#719689",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "https://kb.cert.org/vuls/id/719689/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "The web application portal of the Cobham EXPLORER 710, firmware version 1.07, allows unauthenticated access to a port that can run AT commands",
"x_generator": {
"engine": "Vulnogram 0.0.8"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cert@cert.org",
"DATE_PUBLIC": "2019-10-09T04:00:00.000Z",
"ID": "CVE-2019-9531",
"STATE": "PUBLIC",
"TITLE": "The web application portal of the Cobham EXPLORER 710, firmware version 1.07, allows unauthenticated access to a port that can run AT commands"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Explorer 710",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.07",
"version_value": "1.07"
}
]
}
}
]
},
"vendor_name": "Cobham plc"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "This issue was found by Kyle O\u0027Meara and David Belasco."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The web application portal of the Cobham EXPLORER 710, firmware version 1.07, allows unauthenticated access to port 5454. This could allow an unauthenticated, remote attacker to connect to this port via Telnet and execute 86 Attention (AT) commands, including some that provide unauthenticated, shell-like access to the device."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.8"
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-284 Improper Access Control"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "VU#719689",
"refsource": "CERT-VN",
"url": "https://kb.cert.org/vuls/id/719689/"
}
]
},
"source": {
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2019-9531",
"datePublished": "2019-10-10T20:09:47.705125Z",
"dateReserved": "2019-03-01T00:00:00",
"dateUpdated": "2024-09-16T20:02:16.560Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-9534 (GCVE-0-2019-9534)
Vulnerability from nvd – Published: 2019-10-10 20:09 – Updated: 2024-09-17 00:15
VLAI?
Title
The Cobham EXPLORER 710, firmware version 1.07, does not validate its firmware image
Summary
The Cobham EXPLORER 710, firmware version 1.07, does not validate its firmware image. Development scripts left in the firmware can be used to upload a custom firmware image that the device runs. This could allow an unauthenticated, local attacker to upload their own firmware that could be used to intercept or modify traffic, spoof or intercept GPS traffic, exfiltrate private data, hide a backdoor, or cause a denial-of-service.
Severity ?
No CVSS data available.
CWE
- CWE-494 - Download of Code Without Integrity Check
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cobham plc | Explorer 710 |
Affected:
1.07
|
Credits
This issue was found by Kyle O'Meara and David Belasco.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T21:54:44.413Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "VU#719689",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "https://kb.cert.org/vuls/id/719689/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Explorer 710",
"vendor": "Cobham plc",
"versions": [
{
"status": "affected",
"version": "1.07"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This issue was found by Kyle O\u0027Meara and David Belasco."
}
],
"datePublic": "2019-10-09T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The Cobham EXPLORER 710, firmware version 1.07, does not validate its firmware image. Development scripts left in the firmware can be used to upload a custom firmware image that the device runs. This could allow an unauthenticated, local attacker to upload their own firmware that could be used to intercept or modify traffic, spoof or intercept GPS traffic, exfiltrate private data, hide a backdoor, or cause a denial-of-service."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-494",
"description": "CWE-494 Download of Code Without Integrity Check",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-10-10T20:09:47",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"name": "VU#719689",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "https://kb.cert.org/vuls/id/719689/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "The Cobham EXPLORER 710, firmware version 1.07, does not validate its firmware image",
"x_generator": {
"engine": "Vulnogram 0.0.8"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cert@cert.org",
"DATE_PUBLIC": "2019-10-09T04:00:00.000Z",
"ID": "CVE-2019-9534",
"STATE": "PUBLIC",
"TITLE": "The Cobham EXPLORER 710, firmware version 1.07, does not validate its firmware image"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Explorer 710",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.07",
"version_value": "1.07"
}
]
}
}
]
},
"vendor_name": "Cobham plc"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "This issue was found by Kyle O\u0027Meara and David Belasco."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Cobham EXPLORER 710, firmware version 1.07, does not validate its firmware image. Development scripts left in the firmware can be used to upload a custom firmware image that the device runs. This could allow an unauthenticated, local attacker to upload their own firmware that could be used to intercept or modify traffic, spoof or intercept GPS traffic, exfiltrate private data, hide a backdoor, or cause a denial-of-service."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.8"
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-494 Download of Code Without Integrity Check"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "VU#719689",
"refsource": "CERT-VN",
"url": "https://kb.cert.org/vuls/id/719689/"
}
]
},
"source": {
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2019-9534",
"datePublished": "2019-10-10T20:09:47.814464Z",
"dateReserved": "2019-03-01T00:00:00",
"dateUpdated": "2024-09-17T00:15:54.409Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-9533 (GCVE-0-2019-9533)
Vulnerability from nvd – Published: 2019-10-10 20:09 – Updated: 2024-09-16 16:28
VLAI?
Title
The root password of the Cobham EXPLORER 710 is the same for all versions of firmware up to and including v1.08
Summary
The root password of the Cobham EXPLORER 710 is the same for all versions of firmware up to and including v1.08. This could allow an attacker to reverse-engineer the password from available versions to gain authenticated access to the device.
Severity ?
No CVSS data available.
CWE
- CWE-522 - Insufficiently Protected Credentials
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cobham plc | Explorer 710 |
Affected:
1.08 , ≤ 1.08
(custom)
|
Credits
This issue was found by Kyle O'Meara and David Belasco.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T21:54:44.145Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "VU#719689",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "https://kb.cert.org/vuls/id/719689/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Explorer 710",
"vendor": "Cobham plc",
"versions": [
{
"lessThanOrEqual": "1.08",
"status": "affected",
"version": "1.08",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This issue was found by Kyle O\u0027Meara and David Belasco."
}
],
"datePublic": "2019-10-09T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The root password of the Cobham EXPLORER 710 is the same for all versions of firmware up to and including v1.08. This could allow an attacker to reverse-engineer the password from available versions to gain authenticated access to the device."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "CWE-522: Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-10-10T20:09:47",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"name": "VU#719689",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "https://kb.cert.org/vuls/id/719689/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "The root password of the Cobham EXPLORER 710 is the same for all versions of firmware up to and including v1.08",
"x_generator": {
"engine": "Vulnogram 0.0.8"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cert@cert.org",
"DATE_PUBLIC": "2019-10-09T04:00:00.000Z",
"ID": "CVE-2019-9533",
"STATE": "PUBLIC",
"TITLE": "The root password of the Cobham EXPLORER 710 is the same for all versions of firmware up to and including v1.08"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Explorer 710",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "1.08",
"version_value": "1.08"
}
]
}
}
]
},
"vendor_name": "Cobham plc"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "This issue was found by Kyle O\u0027Meara and David Belasco."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The root password of the Cobham EXPLORER 710 is the same for all versions of firmware up to and including v1.08. This could allow an attacker to reverse-engineer the password from available versions to gain authenticated access to the device."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.8"
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-522: Insufficiently Protected Credentials"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "VU#719689",
"refsource": "CERT-VN",
"url": "https://kb.cert.org/vuls/id/719689/"
}
]
},
"source": {
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2019-9533",
"datePublished": "2019-10-10T20:09:47.781734Z",
"dateReserved": "2019-03-01T00:00:00",
"dateUpdated": "2024-09-16T16:28:25.213Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}