Description (CNA)
In multiple Tecson Tankspion and GOKs SmartBox 4 products the affected application doesn't properly restrict access to an endpoint that is responsible for saving settings, to a unauthenticated user with limited access rights. Based on the lack of adequately implemented access-control rules, by accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to change the application settings without authenticating at all, which violates originally laid ACL rules.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| TECSON / e-litro net | affected unspecified before V6.32 |
| TECSON / LX-Net | affected unspecified before V6.32 |
| TECSON / LX-Q-Net | affected unspecified before V6.32 |
| GOK / SmartBox 4 LAN | affected unspecified before V6.3 |
| GOK / SmartBox 4 LAN PRO | affected unspecified before V6.3 |
CWE
CWE-287
References
ADP enrichment
No English description supplied.