EasyIO 30P up to 2.0.5.26 webuser.js Stored improper authentication

Summaryinfo

A vulnerability was found in EasyIO 30P up to 2.0.5.26 and classified as critical. This affects an unknown function of the file /EASYIO30P-123456789012345678901234567890123456789012345678/webuser.js. The manipulation results in improper authentication (Stored). This vulnerability is cataloged as CVE-2018-15819. The attack may be launched remotely. Furthermore, there is an exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in EasyIO 30P up to 2.0.5.26. Affected is an unknown code of the file /EASYIO30P-123456789012345678901234567890123456789012345678/webuser.js. The manipulation with an unknown input leads to a improper authentication vulnerability (Stored). CWE is classifying the issue as CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

EasyIO EasyIO-30P devices before 2.0.5.27 have Incorrect Access Control, related to webuser.js.

The bug was discovered 08/03/2018. The weakness was shared 04/07/2019 as EasyIO 30P: CVE-2018-15820 (Stored XSS) and CVE-2018-15819 (Authentication bypass) as confirmed mailinglist post (Full-Disclosure). The advisory is shared for download at seclists.org. The vendor cooperated in the coordination of the public release. This vulnerability is traded as CVE-2018-15819 since 08/23/2018. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details and a public exploit are known.

After immediately, there has been an exploit disclosed. The exploit is shared for download at seclists.org. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 66 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 2.0.5.27 eliminates this vulnerability. A possible mitigation has been published even before and not after the disclosure of the vulnerability.

The entry VDB-133283 is related to this item. Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• EasyIO

Name

• 30P

Version

• 2.0.5.0
• 2.0.5.1
• 2.0.5.2
• 2.0.5.3
• 2.0.5.4
• 2.0.5.5
• 2.0.5.6
• 2.0.5.7
• 2.0.5.8
• 2.0.5.9
• 2.0.5.10
• 2.0.5.11
• 2.0.5.12
• 2.0.5.13
• 2.0.5.14
• 2.0.5.15
• 2.0.5.16
• 2.0.5.17
• 2.0.5.18
• 2.0.5.19
• 2.0.5.20
• 2.0.5.21
• 2.0.5.22
• 2.0.5.23
• 2.0.5.24
• 2.0.5.25
• 2.0.5.26

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion