CVE-2019-9534
CVSS V2 High 7.2
CVSS V3 High 7.8
Description
The Cobham EXPLORER 710, firmware version 1.07, does not validate its firmware image. Development scripts left in the firmware can be used to upload a custom firmware image that the device runs. This could allow an unauthenticated, local attacker to upload their own firmware that could be used to intercept or modify traffic, spoof or intercept GPS traffic, exfiltrate private data, hide a backdoor, or cause a denial-of-service.
Overview
- CVE ID
- CVE-2019-9534
- Assigner
- cret@cert.org
- Vulnerability Status
- Analyzed
- Published Version
- 2019-10-10T20:15:11
- Last Modified Date
- 2019-10-16T18:07:27
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| AND | ||||
| cpe:2.3:o:cobham:explorer_710_firmware:1.07:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:h:cobham:explorer_710:-:*:*:*:*:*:*:* | 0 | OR |
CVSS Version 2
- Version
- 2.0
- Vector String
- AV:L/AC:L/Au:N/C:C/I:C/A:C
- Access Vector
- LOCAL
- Access Compatibility
- LOW
- Authentication
- NONE
- Confidentiality Impact
- COMPLETE
- Integrity Impact
- COMPLETE
- Availability Impact
- COMPLETE
- Base Score
- 7.2
- Severity
- HIGH
- Exploitability Score
- 3.9
- Impact Score
- 10
CVSS Version 3
- Version
- 3.1
- Vector String
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Attack Vector
- LOCAL
- Attack Compatibility
- LOW
- Privileges Required
- LOW
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality Impact
- HIGH
- Availability Impact
- HIGH
- Base Score
- 7.8
- Base Severity
- HIGH
- Exploitability Score
- 1.8
- Impact Score
- 5.9
References
| Reference URL | Reference Tags |
|---|---|
| https://kb.cert.org/vuls/id/719689/ | Third Party Advisory US Government Resource |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2019-9534 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9534 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2022-05-10 17:01:58 | Added to TrackCVE | |||
| 2022-12-04 04:13:28 | cert@cert.org | cret@cert.org | CVE Assigner | updated |
| 2022-12-04 04:13:28 | 2019-10-10T20:15Z | 2019-10-10T20:15:11 | CVE Published Date | updated |
| 2022-12-04 04:13:28 | 2019-10-16T18:07:27 | CVE Modified Date | updated | |
| 2022-12-04 04:13:28 | Analyzed | Vulnerability Status | updated |