high7.5
CVE-2019-9105
The WebApp v04.68 in the supervisor on SAET Impianti Speciali TEBE Small 05.01 build 1137 devices allows remote attackers to make several types of API calls wi…
Impact
The WebApp v04.68 in the supervisor on SAET Impianti Speciali TEBE Small 05.01 build 1137 devices allows remote attackers to make several types of API calls without authentication, as demonstrated by retrieving password hashes via an inc/utils/REST_API.php?command=CallAPI&customurl=alladminusers call.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Saet | Tebe Small Firmware | Version 05.01 |
| Saet | Webapp | Version 04.68 |
Weakness classification
References
- NVD record
- CVE.org record
- https://members.backbox.org/saet-tebe-small-supervisor-multiple-vulnerabilities/
- https://www.saet.org/wp-content/uploads/2017/04/Depliant_TEBE-TEBE_Small.pdf
- https://members.backbox.org/saet-tebe-small-supervisor-multiple-vulnerabilities/
- https://www.saet.org/wp-content/uploads/2017/04/Depliant_TEBE-TEBE_Small.pdf