Vulnerability Description
An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044_update_05032019-482. They replace secure and protected directory permissions (set as default by the underlying operating system) with highly insecure read, write, and execute directory permissions for all users. By default, /usr/local and all of its subdirectories should have permissions set to only allow non-privileged users to read and execute from the tree structure, and to deny users from creating or editing files in this location. The ENTTEC firmware startup script permits all users to read, write, and execute (rwxrwxrwx) from the /usr, /usr/local, /usr/local/dmxis, and /usr/local/bin/ directories.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Enttec | Datagate Mk2 Firmware | 70044 |
| Enttec | Datagate Mk2 | - |
| Enttec | Storm 24 Firmware | 70044 |
| Enttec | Storm 24 | - |
| Enttec | Pixelator Firmware | 70044 |
| Enttec | Pixelator | - |
| Enttec | E-Streamer Mk2 Firmware | 70044 |
| Enttec | E-Streamer Mk2 | - |
Related Weaknesses (CWE)
References
- https://www.mogozobo.com/?p=3476ExploitThird Party Advisory
- https://www.mogozobo.com/?p=3476ExploitThird Party Advisory
FAQ
What is CVE-2019-12777?
CVE-2019-12777 is a vulnerability with a CVSS score of 7.8 (HIGH). An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044_update_05032019-482. They replace secure and protected directory permissions (set as def...
How severe is CVE-2019-12777?
CVE-2019-12777 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-12777?
Check the references section above for vendor advisories and patch information. Affected products include: Enttec Datagate Mk2 Firmware, Enttec Datagate Mk2, Enttec Storm 24 Firmware, Enttec Storm 24, Enttec Pixelator Firmware.