Anviz Firmware
CVE-2019-12388
HIGH
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
1DescriptionNVD
Anviz access control devices perform cleartext transmission of sensitive information (passwords/pins and names) when replying to query on port tcp/5010.
AnalysisAI
Anviz access control devices perform cleartext transmission of sensitive information (passwords/pins and names) when replying to query on port tcp/5010. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-319. Anviz access control devices perform cleartext transmission of sensitive information (passwords/pins and names) when replying to query on port tcp/5010. Affected products include: Anviz Anviz Firmware.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
More in Anviz Firmware
View allAnviz access control devices allow remote attackers to issue commands without a password. Rated critical severity (CVSS
Anviz access control devices expose credentials (names and passwords) by allowing remote attackers to query this informa
Anviz access control devices expose private Information (pin code and name) by allowing remote attackers to query this i
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today