Most recent entries from all

cnvd-2020-49319

EUVD-2026-162438

fkie_cve-2019-14925

An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. A world-readable /usr/smartrtu/init/settings.xml configuration file on the file system allows an attacker to read sensitive configuration settings such as usernames, passwords, and other sensitive RTU data due to insecure permission assignment.

GHSA-gqfm-cqpj-28j8

An issue was discovered on Mitsubishi Electric ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. A world-readable /usr/smartrtu/init/settings.xml configuration file on the file system allows an attacker to read sensitive configuration settings such as usernames, passwords, and other sensitive RTU data due to insecure permission assignment.

gsd-2019-14925

ICSA-21-252-03 — Mitsubishi Electric Europe B.V. smartRTU and INEA ME-RTU

The affected product allows an attacker to execute arbitrary commands due to the passing of unsafe user supplied data to the system shell.CVE-2019-14931 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). It is possible to download the affected product 's configuration file, which contains sensitive data, through the URL.CVE-2019-14927 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The affected product 's web configuration software allows an authenticated user to inject malicious data into the application that can then be executed in a victim 's browser, allowing stored cross-site scripting.CVE-2019-14928 has been assigned to this vulnerability. A CVSS v3 base score of 5.4 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Hard-coded SSH keys have been identified in the affected product 's firmware. As the secure keys cannot be regenerated by a user and are not regenerated on firmware updates, all deployed affected products utilize the same SSH keys.CVE-2019-14926 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The affected products contain undocumented user accounts with hard-coded password credentials. An attacker could exploi…