CVE-2019-6814 Auth bypass in ÊNET55XX Encoder with firmware prior to version 2.1.9.Ê
Remote attackers can bypass authentication on the NET55XX Encoder webUI, compromising confidentiality, integrity, and availability.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-6814?
CVE-2019-6814 is a critical authentication bypass vulnerability in ÊNET55XX Encoder with firmware prior to version 2.1.9.Ê, published on 22 May 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A CWE-287: Improper Authentication vulnerability exists in the NET55XX Encoder with firmware prior to version 2.1.9.7 which could cause impact to confidentiality, integrity, and availability when a remote attacker crafts a malicious request to the encoder webUI.
Weakness: CWE-287
Which versions are affected by CVE-2019-6814?
It affects 7 products.
Products include Schneider-Electric Net5500 Firmware, Schneider-Electric Net5501-I Firmware, Schneider-Electric Net5501-Xt Firmware, Schneider-Electric Net5501 Firmware, Schneider-Electric Net5504 Firmware, Schneider-Electric Net5508 Firmware and 1 more.
How do I fix CVE-2019-6814?
No fix has been published for CVE-2019-6814 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2019-6814 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-6814 exists.
Public exploit code: 1 Metasploit module and 2 Exploit-DB entries.
Sources
Also known as GHSA-2784-p9wg-c9fp.