CVE-2019-15067 - Vulnerability Details - OpenCVE

An authentication bypass vulnerability discovered in Smart Battery A2-25DE, a multifunctional portable charger, firmware version ?<= SECFS-2013-10-16-13:42:58-629c30ee-60c68be6. An attacker can bypass authentication and gain privilege by modifying the login page.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

This CVE is not in the KEV list.

The EPSS score is 0.00388.

Key SSVC decision points have not yet been added.

Vendors	Products
Gigastone	Smart Battery A2-25de Smart Battery A2-25de Firmware

Configuration 1 [-]

AND

cpe:2.3:o:gigastone:smart_battery_a2-25de_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:gigastone:smart_battery_a2-25de:-:*:*:*:*:*:*:*

No data.

No data.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://tvn.twcert.org.tw/taiwanvn/TVN-201908002
https://www.twcert.org.tw/subpages/ServeThePublic/public_document_details.aspx?lang=en-US&id=44

History

No history.

MITRE

Status: PUBLISHED

Assigner: twcert

Published: 2019-09-25T18:10:15.597509Z

Updated: 2024-09-16T17:48:11.809Z

Reserved: 2019-08-15T00:00:00

Link: CVE-2019-15067

Vulnrichment

No data.

NVD

Status : Modified

Published: 2019-09-25T19:15:10.487

Modified: 2024-11-21T04:27:59.230

Link: CVE-2019-15067

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "Smart Battery A2-25DE", "vendor": "Gigastone", "versions": [{"lessThanOrEqual": "SECFS-2013-10-16-13:42:58-629c30ee-60c68be6", "status": "unknown", "version": "Firmware", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Leon Chen, Y.D. Chen, Laura Tzou, Mars Cheng, Julian Chen"}], "datePublic": "2019-09-24T00:00:00", "descriptions": [{"lang": "en", "value": "An authentication bypass vulnerability discovered in Smart Battery A2-25DE, a multifunctional portable charger, firmware version ?<= SECFS-2013-10-16-13:42:58-629c30ee-60c68be6. An attacker can bypass authentication and gain privilege by modifying the login page."}], "problemTypes": [{"descriptions": [{"description": "Authentication bypass", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-09-25T18:10:15", "orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201908002"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.twcert.org.tw/subpages/ServeThePublic/public_document_details.aspx?lang=en-US&id=44"}], "source": {"discovery": "EXTERNAL"}, "title": "An authentication bypass vulnerability discovered in Smart Battery A2-25DE", "x_generator": {"engine": "Vulnogram 0.0.8"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@cert.org.tw", "DATE_PUBLIC": "2019-09-24T16:00:00.000Z", "ID": "CVE-2019-15067", "STATE": "PUBLIC", "TITLE": "An authentication bypass vulnerability discovered in Smart Battery A2-25DE"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Smart Battery A2-25DE", "version": {"version_data": [{"version_affected": "?<=", "version_name": "Firmware", "version_value": "SECFS-2013-10-16-13:42:58-629c30ee-60c68be6"}]}}]}, "vendor_name": "Gigastone"}]}}, "credit": [{"lang": "eng", "value": "Leon Chen, Y.D. Chen, Laura Tzou, Mars Cheng, Julian Chen"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "An authentication bypass vulnerability discovered in Smart Battery A2-25DE, a multifunctional portable charger, firmware version ?<= SECFS-2013-10-16-13:42:58-629c30ee-60c68be6. An attacker can bypass authentication and gain privilege by modifying the login page."}]}, "generator": {"engine": "Vulnogram 0.0.8"}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Authentication bypass"}]}]}, "references": {"reference_data": [{"name": "https://tvn.twcert.org.tw/taiwanvn/TVN-201908002", "refsource": "CONFIRM", "url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201908002"}, {"name": "https://www.twcert.org.tw/subpages/ServeThePublic/public_document_details.aspx?lang=en-US&id=44", "refsource": "CONFIRM", "url": "https://www.twcert.org.tw/subpages/ServeThePublic/public_document_details.aspx?lang=en-US&id=44"}]}, "source": {"discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T00:34:53.215Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201908002"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.twcert.org.tw/subpages/ServeThePublic/public_document_details.aspx?lang=en-US&id=44"}]}]}, "cveMetadata": {"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "assignerShortName": "twcert", "cveId": "CVE-2019-15067", "datePublished": "2019-09-25T18:10:15.597509Z", "dateReserved": "2019-08-15T00:00:00", "dateUpdated": "2024-09-16T17:48:11.809Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:gigastone:smart_battery_a2-25de_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "CAECCA73-9A97-45B6-B505-2FB79FAD2067", "versionEndIncluding": "2013-10-16", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:gigastone:smart_battery_a2-25de:-:*:*:*:*:*:*:*", "matchCriteriaId": "A436B82A-C752-4E36-834D-4C89749BF8FA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "An authentication bypass vulnerability discovered in Smart Battery A2-25DE, a multifunctional portable charger, firmware version ?<= SECFS-2013-10-16-13:42:58-629c30ee-60c68be6. An attacker can bypass authentication and gain privilege by modifying the login page."}, {"lang": "es", "value": "Se detect\u00f3 una vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n en Smart Battery A2-25DE, un cargador port\u00e1til multifuncional, versi\u00f3n de firmware anterior a SECFS-2013-10-16-13: 42: 58-629c30ee-60c68be6 (incluy\u00e9ndola) . Un atacante puede omitir la autenticaci\u00f3n y alcanzar privilegios modificando la p\u00e1gina de inicio de sesi\u00f3n."}], "id": "CVE-2019-15067", "lastModified": "2024-11-21T04:27:59.230", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-09-25T19:15:10.487", "references": [{"source": "twcert@cert.org.tw", "tags": ["Third Party Advisory"], "url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201908002"}, {"source": "twcert@cert.org.tw", "tags": ["Third Party Advisory"], "url": "https://www.twcert.org.tw/subpages/ServeThePublic/public_document_details.aspx?lang=en-US&id=44"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201908002"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://www.twcert.org.tw/subpages/ServeThePublic/public_document_details.aspx?lang=en-US&id=44"}], "sourceIdentifier": "twcert@cert.org.tw", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}