CVE-2019-12777

An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044_update_05032019-482. They replace secure and protected directory permissions (set as default by the underlying operating system) with highly insecure read, write, and execute directory permissions for all users. By default, /usr/local and all of its subdirectories should have permissions set to only allow non-privileged users to read and execute from the tree structure, and to deny users from creating or editing files in this location. The ENTTEC firmware startup script permits all users to read, write, and execute (rwxrwxrwx) from the /usr, /usr/local, /usr/local/dmxis, and /usr/local/bin/ directories.

• CWE-732

• https://www.mogozobo.com/?p=3476Exploit, Third Party Advisory
• https://www.mogozobo.com/?p=3476Exploit, Third Party Advisory

Published

Jun 7, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-1277An elevation of privilege vulnerability exists in Windows Au…7.8
• CVE-2019-12771Command injection is possible in ThinStation through 6.1.1 v…
• CVE-2019-12773An issue was discovered in Verint Impact 360 15.1. At wfo/he…6.1
• CVE-2019-12774A number of stored XSS vulnerabilities have been identified …
• CVE-2019-12775An issue was discovered on the ENTTEC Datagate MK2, Storm 24…
• CVE-2019-12776An issue was discovered on the ENTTEC Datagate MK2, Storm 24…
• CVE-2019-12779libqb before 1.0.5 allows local users to overwrite arbitrary…
• CVE-2019-1278An elevation of privilege vulnerability exists in the way th…7.8
• CVE-2019-12780The Belkin Wemo Enabled Crock-Pot allows command injection i…
• CVE-2019-12781An issue was discovered in Django 1.11 before 1.11.22, 2.1 b…
• CVE-2019-12782An authorization bypass vulnerability in pinboard updates in…
• CVE-2019-12783An issue was discovered in Verint Impact 360 15.1. At wfo/co…6.1