VDE-2020-043 — Bender: COMTRAXX < 4.2.0 affected by inadquate credentials check vulnerability

Summary

Bender is publishing this advisory to inform customers about a security vulnerability in all devices running the COMTRAXX software.

The user authorization is validated for most, but not all routes in the system. A user with knowledge about the routes can read and write configuration data without prior authorization.

Details

Impact
The vulnerability allows a malicious entity to bypass credential check.

Mitigation
• restrict network access to the above-mentioned devices

• install latest software update

Remediation
Please install V4.2.0. (https://www.bender.de/service-support/downloadbereich)

Vulnerabilities 1

Unscored —

CVE-2019-19885

In Bender COMTRAXX, user authorization is validated for most, but not all, routes in the system. A user with knowledge …

Oct 16, 2020

Revision history

2020-10-16 #1
Initial revision.

References

CERT@VDE Security Advisories for Bender GmbH & Co. KG
https://certvde.com/en/advisories/vendor/bender
VDE-2020-043: Bender: COMTRAXX < 4.2.0 affected by inadquate credentials check vulnerability - HTML
https://certvde.com/en/advisories/VDE-2020-043