CVE-2019-13402

CWE-2123 documents3 sources

Severity

8.8HIGH

EPSS

0.4%

top 39.22%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Fortinet Fcm-mb40 Firmware

Timeline

PublishedJul 8

Latest updateMay 24

Description

/usr/sbin/default.sh and /usr/apache/htdocs/cgi-bin/admin/hardfactorydefault.cgi on Dynacolor FCM-MB40 v1.2.0.0 devices implement an incomplete factory-reset process. A backdoor can persist because neither system accounts nor the set of services is reset.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages1 packages

▶NVDfortinet/fcm-mb40_firmware1.2.0.0

🔴Vulnerability Details

GHSA

GHSA-7vjq-xg45-8px3: /usr/sbin/default↗2022-05-24

▶

CVEList

CVE-2019-13402: /usr/sbin/default↗2019-07-08

▶