CVEvulnerability
CVE-2019-9105
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2019-05-31
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-306
Description
The WebApp v04.68 in the supervisor on SAET Impianti Speciali TEBE Small 05.01 build 1137 devices allows remote attackers to make several types of API calls without authentication, as demonstrated by retrieving password hashes via an inc/utils/REST_API.php?command=CallAPI&customurl=alladminusers call.
Affected configurations
• saet tebe small firmware 05.01
• saet webapp 04.68
Related
Weakness · CWE (1)
- CWE-306 Missing Authentication for Critical Functionality weakness
References
- https://members.backbox.org/saet-tebe-small-supervisor-multiple-vulnerabilities/ Exploit, Third Party Advisory
- https://www.saet.org/wp-content/uploads/2017/04/Depliant_TEBE-TEBE_Small.pdf Product, Vendor Advisory
- https://members.backbox.org/saet-tebe-small-supervisor-multiple-vulnerabilities/ Exploit, Third Party Advisory
- https://www.saet.org/wp-content/uploads/2017/04/Depliant_TEBE-TEBE_Small.pdf Product, Vendor Advisory