CVE-2019-19885
Critical
Description
In Bender COMTRAXX, user authorization is validated for most, but not all, routes in the system. A user with knowledge about the routes can read and write configuration data without prior authorization. This affects COM465IP, COM465DP, COM465ID, CP700, CP907, and CP915 devices before 4.2.0.
SeverityCritical
CVSS9.1
Exploit probability—
ProductBender Com465ip Firmware
PublishedOct 16, 2020
First seenOct 16, 2020
How to fix
Update
- bender com465ip_firmware4.2.0 or later
- bender com465dp_firmware4.2.0 or later
- bender com465id_firmware4.2.0 or later
- bender cp700_firmware4.2.0 or later
- bender cp907_firmware4.2.0 or later
- bender cp915_firmware4.2.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| bender com465ip_firmware | v < 4.2.0 | 4.2.0 |
| bender com465dp_firmware | v < 4.2.0 | 4.2.0 |
| bender com465id_firmware | v < 4.2.0 | 4.2.0 |
| bender cp700_firmware | v < 4.2.0 | 4.2.0 |
| bender cp907_firmware | v < 4.2.0 | 4.2.0 |
| bender cp915_firmware | v < 4.2.0 | 4.2.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.