Medium severity · published Jan 7, 2020
CVE-2019-6529
An attacker could specially craft an FTP request that could crash the PR100088 Modbus gateway versions prior to release R02 (or Software Version 1.1.13166)
4.9
CVSS
1%
EPSS
No
On KEV
Description
An attacker could specially craft an FTP request that could crash the PR100088 Modbus gateway versions prior to release R02 (or Software Version 1.1.13166).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 63% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PM
Pr100088 Modbus Gateway Firmware · Kunbus
before 1.1.13166 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-6529
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-6529
Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-19-036-05
More from Pr100088 Modbus Gateway Firmware
9.8
CVE-2019-6527
PR100088 Modbus gateway versions prior to Release R02 (or Software Version 1.1.13166) may allow an attacker to be able to change the password for an admin user who is currently or…
9.1
CVE-2019-6533
Registers used to store Modbus values can be read and written from the web interface without authentication in the PR100088 Modbus gateway versions prior to Release R02 (or…
8.1
CVE-2019-6531
An attacker could retrieve passwords from a HTTP GET request from the Kunbus PR100088 Modbus gateway versions prior to Release R02 (or Software Version 1.1.13166) if the attacker…
7.2
CVE-2019-6549
An attacker could retrieve plain-text credentials stored in a XML file on PR100088 Modbus gateway versions prior to Release R02 (or Software Version 1.1.13166) through FTP