CVE-2019-12774
Last modified
CVE-2019-12774 is a vulnerability of currently unknown severity. A number of stored XSS vulnerabilities have been identified in the web configuration feature in ENTTEC Datagate Mk2 70044_update_05032019-482 that could allow an unauthenticated threat actor to inject malicious code directly into the application. This affects, for example, the Profile Description field in JSON data to the Profile Editor.. EPSS estimates a 0.82% chance of exploitation in the next 30 days.
Description
A number of stored XSS vulnerabilities have been identified in the web configuration feature in ENTTEC Datagate Mk2 70044_update_05032019-482 that could allow an unauthenticated threat actor to inject malicious code directly into the application. This affects, for example, the Profile Description field in JSON data to the Profile Editor.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Enttec | Datagate Mk2 Firmware | 70044 | 05032019-482 |
| Enttec | Storm 24 Firmware | 70044 | 05032019-482 |
| Enttec | Pixelator Firmware | 70044 | 05032019-482 |
| Enttec | E-Streamer Mk2 Firmware | 70044 | 05032019-482 |
References
- https://www.mogozobo.com/?p=3476Exploit, Third Party Advisory
- https://www.mogozobo.com/?p=3476Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-12774?
How severe is CVE-2019-12774?
How do I fix CVE-2019-12774?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-12767An issue was discovered on D-Link DAP-1650 devices before 1.…9.8
- CVE-2019-12768An issue was discovered on D-Link DAP-1650 devices through v…9.8
- CVE-2019-12769SolarWinds Serv-U Managed File Transfer (MFT) Web client bef…8.8
- CVE-2019-1277An elevation of privilege vulnerability exists in Windows Au…7.8
- CVE-2019-12771Command injection is possible in ThinStation through 6.1.1 v…
- CVE-2019-12773An issue was discovered in Verint Impact 360 15.1. At wfo/he…6.1
- CVE-2019-12775An issue was discovered on the ENTTEC Datagate MK2, Storm 24…
- CVE-2019-12776An issue was discovered on the ENTTEC Datagate MK2, Storm 24…
- CVE-2019-12777An issue was discovered on the ENTTEC Datagate MK2, Storm 24…
- CVE-2019-12779libqb before 1.0.5 allows local users to overwrite arbitrary…
- CVE-2019-1278An elevation of privilege vulnerability exists in the way th…7.8
- CVE-2019-12780The Belkin Wemo Enabled Crock-Pot allows command injection i…
Are you affected by CVE-2019-12774?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST