CVE-2019-6558 - Vulnerability Details - OpenCVE

In Auto-Maskin RP210E Versions 3.7 and prior, DCU210E Versions 3.7 and prior and Marine Observer Pro (Android App), the software contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00216.

Key SSVC decision points have not yet been added.

Vendors	Products
Auto-maskin	Dcu 210e Dcu 210e Firmware Marine Pro Observer Rp 210e Rp 210e Firmware

Configuration 1 [-]

AND

cpe:2.3:o:auto-maskin:rp_210e_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:auto-maskin:rp_210e:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:auto-maskin:dcu_210e_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:auto-maskin:dcu_210e:-:*:*:*:*:*:*:*

Configuration 3 [-]

cpe:2.3:a:auto-maskin:marine_pro_observer:-:*:*:*:*:android:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2019-16117	In Auto-Maskin RP210E Versions 3.7 and prior, DCU210E Versions 3.7 and prior and Marine Observer Pro (Android App), the software contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://www.us-cert.gov/ics/advisories/icsa-20-051-04

History

No history.

MITRE

Status: PUBLISHED

Assigner: icscert

Published: 2020-03-23T20:07:03

Updated: 2024-08-04T20:23:21.499Z

Reserved: 2019-01-22T00:00:00

Link: CVE-2019-6558

Vulnrichment

No data.

NVD

Status : Modified

Published: 2020-03-23T21:15:12.020

Modified: 2024-11-21T04:46:41.553

Link: CVE-2019-6558

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "Auto-Maskin RP210E Versions 3.7 and prior DCU210E Versions 3.7 and prior and Marine Observer Pro (Android App)", "vendor": "n/a", "versions": [{"status": "affected", "version": "Auto-Maskin RP210E Versions 3.7 and prior DCU210E Versions 3.7 and prior and Marine Observer Pro (Android App)"}]}], "descriptions": [{"lang": "en", "value": "In Auto-Maskin RP210E Versions 3.7 and prior, DCU210E Versions 3.7 and prior and Marine Observer Pro (Android App), the software contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-521", "description": "WEAK PASSWORD REQUIREMENTS CWE-521", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-03-23T20:07:03", "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.us-cert.gov/ics/advisories/icsa-20-051-04"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "ics-cert@hq.dhs.gov", "ID": "CVE-2019-6558", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Auto-Maskin RP210E Versions 3.7 and prior DCU210E Versions 3.7 and prior and Marine Observer Pro (Android App)", "version": {"version_data": [{"version_value": "Auto-Maskin RP210E Versions 3.7 and prior DCU210E Versions 3.7 and prior and Marine Observer Pro (Android App)"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "In Auto-Maskin RP210E Versions 3.7 and prior, DCU210E Versions 3.7 and prior and Marine Observer Pro (Android App), the software contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "WEAK PASSWORD REQUIREMENTS CWE-521"}]}]}, "references": {"reference_data": [{"name": "https://www.us-cert.gov/ics/advisories/icsa-20-051-04", "refsource": "MISC", "url": "https://www.us-cert.gov/ics/advisories/icsa-20-051-04"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T20:23:21.499Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.us-cert.gov/ics/advisories/icsa-20-051-04"}]}]}, "cveMetadata": {"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "assignerShortName": "icscert", "cveId": "CVE-2019-6558", "datePublished": "2020-03-23T20:07:03", "dateReserved": "2019-01-22T00:00:00", "dateUpdated": "2024-08-04T20:23:21.499Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:auto-maskin:rp_210e_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "4ADA8169-10DE-4D5D-8C53-108EB7C030DF", "versionEndIncluding": "3.7", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:auto-maskin:rp_210e:-:*:*:*:*:*:*:*", "matchCriteriaId": "2B7F66D3-0436-4BF6-A177-C04C59BFAEE5", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:auto-maskin:dcu_210e_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "F0C64205-421D-4877-8534-533F22B73E9F", "versionEndIncluding": "3.7", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:auto-maskin:dcu_210e:-:*:*:*:*:*:*:*", "matchCriteriaId": "378677CF-D35D-4122-B481-3B7FCF6F4D27", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:auto-maskin:marine_pro_observer:-:*:*:*:*:android:*:*", "matchCriteriaId": "D9050A5F-13F4-44EC-B1C9-8DB90508AA8D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "In Auto-Maskin RP210E Versions 3.7 and prior, DCU210E Versions 3.7 and prior and Marine Observer Pro (Android App), the software contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak."}, {"lang": "es", "value": "En Auto-Maskin RP210E Versiones 3.7 y anteriores, DCU210E Versiones 3.7 y anteriores y Marine Observer Pro (aplicaci\u00f3n de Android), el software contiene un mecanismo para que los usuarios recuperen o cambien sus contrase\u00f1as sin conocer la contrase\u00f1a original, pero el mecanismo es d\u00e9bil."}], "id": "CVE-2019-6558", "lastModified": "2024-11-21T04:46:41.553", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-03-23T21:15:12.020", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.us-cert.gov/ics/advisories/icsa-20-051-04"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.us-cert.gov/ics/advisories/icsa-20-051-04"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-521"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-521"}], "source": "nvd@nist.gov", "type": "Primary"}]}