CVE-2019-13022

Bond JetSelect (all versions) has an issue in the Java class (ENCtool.jar) and corresponding password generation algorithm (used to set initial passwords upon first installation). It XORs the plaintext into the 'encrypted' password that is then stored within the database. These steps are able to be trivially reversed, allowing for escalation of privilege within the JetSelect application through obtaining the passwords of JetSelect administrators. JetSelect administrators have the ability to modify and delete all networking configuration across a vessel, as well as altering network configuration of all managed network devices (switches, routers).

• CWE-327

• https://labs.nettitude.com/blog/cve-2019-13021-22-23-jetselect-network-segregation-application/Exploit, Third Party Advisory
• https://labs.nettitude.com/blog/cve-2019-13021-22-23-jetselect-network-segregation-application/Exploit, Third Party Advisory

Published

May 14, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-13012The keyfile settings backend in GNOME GLib (aka glib2.0) bef…
• CVE-2019-13013Little Snitch versions 4.3.0 to 4.3.2 have a local privilege…5.5
• CVE-2019-13014Little Snitch versions 4.4.0 fixes a vulnerability in a priv…5.5
• CVE-2019-1302An elevation of privilege vulnerability exists when a ASP.NE…8.8
• CVE-2019-13020The fetch API in Tightrope Media Carousel before 7.1.3 has C…
• CVE-2019-13021The administrative passwords for all versions of Bond JetSel…6.5
• CVE-2019-13023An issue was discovered in all versions of Bond JetSelect. W…6.5
• CVE-2019-13024Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centr…
• CVE-2019-13025Compal CH7465LG CH7465LG-NCIP-6.12.18.24-5p8-NOSH devices ha…9.8
• CVE-2019-13026OXID eShop 6.0.x before 6.0.5 and 6.1.x before 6.1.4 allows …
• CVE-2019-13027Realization Concerto Critical Chain Planner (aka CCPM) 5.10.…
• CVE-2019-13028An incorrect implementation of a local web server in eID cli…