Most recent entries from all

cnvd-2019-47032

EUVD-2026-162441

fkie_cve-2019-14928

An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. A number of stored cross-site script (XSS) vulnerabilities allow an attacker to inject malicious code directly into the application. An example input variable vulnerable to stored XSS is SerialInitialModemString in the index.php page.

GHSA-6c8f-vwhh-x9ch

An issue was discovered on Mitsubishi Electric ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. A number of stored cross-site script (XSS) vulnerabilities allow an attacker to inject malicious code directly into the application. An example input variable vulnerable to stored XSS is SerialInitialModemString in the index.php page.

gsd-2019-14928

ICSA-21-252-03 — Mitsubishi Electric Europe B.V. smartRTU and INEA ME-RTU

The affected product allows an attacker to execute arbitrary commands due to the passing of unsafe user supplied data to the system shell.CVE-2019-14931 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). It is possible to download the affected product 's configuration file, which contains sensitive data, through the URL.CVE-2019-14927 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The affected product 's web configuration software allows an authenticated user to inject malicious data into the application that can then be executed in a victim 's browser, allowing stored cross-site scripting.CVE-2019-14928 has been assigned to this vulnerability. A CVSS v3 base score of 5.4 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Hard-coded SSH keys have been identified in the affected product 's firmware. As the secure keys cannot be regenerated by a user and are not regenerated on firmware updates, all deployed affected products utilize the same SSH keys.CVE-2019-14926 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The affected products contain undocumented user accounts with hard-coded password credentials. An attacker could exploi…