CVE-2019-9530 Missing authorization in Explorer 710

Medium 5.5 Published 10 Oct 2019 Updated 16 Sep 2024

An unauthenticated local attacker can access and download any file from the web root directory of the Cobham EXPLORER 710 due to missing access restrictions.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-9530?

CVE-2019-9530 is a medium-severity missing authorization vulnerability in Cobham plc Explorer 710, published on 10 Oct 2019. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The web root directory of the Cobham EXPLORER 710, firmware version 1.07, has no access restrictions on downloading and reading all files. This could allow an unauthenticated, local attacker connected to the device to access and download any file found in the web root directory.

Weakness: CWE-284

Which versions are affected by CVE-2019-9530?

It affects 1 product.

Products include Cobham Explorer 710 Firmware.

How do I fix CVE-2019-9530?

No fix has been published for CVE-2019-9530 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2019-9530 being exploited?

There is no known exploitation of CVE-2019-9530 in the wild and no public exploit code.

Sources

Also known as GHSA-vfqg-r43j-x694.