CVEvulnerability
CVE-2019-13140
6.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2019-09-16
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
- Weaknesses
- CWE-552
Description
Inteno EG200 EG200-WU7P1U_ADAMO3.16.4-190226_1650 routers have a JUCI ACL misconfiguration that allows the "user" account to extract the 3DES key via JSON commands to ubus. The 3DES key is used to decrypt the provisioning file provided by Adamo Telecom on a public URL via cleartext HTTP.
Affected configurations
• intenogroup eg200 firmware eg200-wu7p1u adamo3.16.4-190226 1650
Related
Weakness · CWE (1)
- CWE-552 Files or Directories Accessible to External Parties weakness
References
- http://packetstormsecurity.com/files/154494/Inteno-IOPSYS-Gateway-3DES-Key-Extraction-Improper-Access.html Exploit, Third Party Advisory, VDB Entry
- https://twitter.com/GerardFuguet/status/1169298861782896642 Third Party Advisory
- https://www.exploit-db.com/docs/47397 Exploit, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/47390 Exploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/154494/Inteno-IOPSYS-Gateway-3DES-Key-Extraction-Improper-Access.html Exploit, Third Party Advisory, VDB Entry
- https://twitter.com/GerardFuguet/status/1169298861782896642 Third Party Advisory
- https://www.exploit-db.com/docs/47397 Exploit, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/47390 Exploit, Third Party Advisory, VDB Entry