Most recent entries from all

EUVD-2026-55248

fkie_cve-2019-12777

An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044_update_05032019-482. They replace secure and protected directory permissions (set as default by the underlying operating system) with highly insecure read, write, and execute directory permissions for all users. By default, /usr/local and all of its subdirectories should have permissions set to only allow non-privileged users to read and execute from the tree structure, and to deny users from creating or editing files in this location. The ENTTEC firmware startup script permits all users to read, write, and execute (rwxrwxrwx) from the /usr, /usr/local, /usr/local/dmxis, and /usr/local/bin/ directories.

GHSA-2vvj-x2x5-ghqg

gsd-2019-12777

ICSA-20-177-01 — ENTTEC Lighting Controllers (Update A)

The lighting controller products include hard-coded SSH keys for remote SSH and SCP access as the root user.CVE-2019-12776 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Several stored XSS vulnerabilities have been identified in ENTTEC 's Datagate Mk2 web configuration software, which could allow an unauthenticated threat actor to inject malicious code directly into the application.CVE-2019-12774 has been assigned to these vulnerabilities. A CVSS v3 base score of 6.1 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The lighting controller products enable high privileged root access via sudo capability without requiring appropriate access control.CVE-2019-12775 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The system replaces permissions by the underlying operating system with highly insecure read, write, and execute directory permissions for all users.CVE-2019-12777 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).