CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0CVE-2021-42538 – Emerson WirelessHART Gateway
https://notcve.org/view.php?id=CVE-2021-42538
The affected product is vulnerable to a parameter injection via passphrase, which enables the attacker to supply uncontrolled input. El producto afectado es vulnerable a una inyección de parámetros por medio de una frase de contraseña, que permite al atacante suministrar entradas no controladas • https://us-cert.cisa.gov/ics/advisories/icsa-21-278-02 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 10.0EPSS: 0%CPEs: 6EXPL: 0CVE-2020-12030 – Emerson WirelessHART Gateway
https://notcve.org/view.php?id=CVE-2020-12030
There is a flaw in the code used to configure the internal gateway firewall when the gateway's VLAN feature is enabled. If a user enables the VLAN setting, the internal gateway firewall becomes disabled resulting in exposure of all ports used by the gateway. Se presenta un fallo en el código usado para configurar el firewall del gateway interno cuando la función VLAN del gateway está activada. Si un usuario habilita la configuración de la VLAN, el firewall del gateway interna se desactiva, resultando en una exposición de todos los puertos usados por el gateway • https://us-cert.cisa.gov/ics/advisories/icsa-20-135-02 • CWE-284: Improper Access Control •
CVSS: 7.5EPSS: 1%CPEs: 2EXPL: 1CVE-2020-19419 – Emerson Smart Wireless Gateway 1420 4.6.59 Missing Authentication
https://notcve.org/view.php?id=CVE-2020-19419
Incorrect Access Control in Emerson Smart Wireless Gateway 1420 4.6.59 allows remote attackers to obtain sensitive device information from the administrator console without authentication. Un Control de Acceso Incorrecto en Emerson Smart Wireless Gateway 1420 versión 4.6.59, permite a atacantes remotos obtener información confidencial del dispositivo desde la consola del administrador sin autenticación Emerson Smart Wireless Gateway version 1420 4.6.59 suffers from a missing authentication vulnerability. • http://packetstormsecurity.com/files/161701/Emerson-Smart-Wireless-Gateway-1420-4.6.59-Missing-Authentication.html https://cwe.mitre.org/data/definitions/306.html • CWE-306: Missing Authentication for Critical Function •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 1CVE-2020-19417 – Emerson Smart Wireless Gateway 1420 4.6.59 Privilege Escalation
https://notcve.org/view.php?id=CVE-2020-19417
Emerson Smart Wireless Gateway 1420 4.6.59 allows non-privileged users (such as the default account 'maint') to perform administrative tasks by sending specially crafted HTTP requests to the application. Emerson Smart Wireless Gateway versión 1420 4.6.59, permite a usuarios no privilegiados (como la cuenta predeterminada "maint") llevar a cabo tareas administrativas mediante el envío de peticiones HTTP especialmente diseñadas a la aplicación Emerson Smart Wireless Gateway version 1420 4.6.59 suffers from a privilege escalation vulnerability. • http://packetstormsecurity.com/files/161700/Emerson-Smart-Wireless-Gateway-1420-4.6.59-Privilege-Escalation.html •