CVE-2019-19105 : The backup function in ABB Telephone Gateway TG/S 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway saves the current setting

The backup function in ABB Telephone Gateway TG/S 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway saves the current settings and configuration of the application, including credentials of existing user accounts and other configuration's credentials in plaintext.

Published 2020-04-22 15:15:14

Updated 2020-04-29 23:17:47

Source Asea Brown Boveri Ltd. (ABB)

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2019-19105

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 10 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-19105

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
2.1	LOW	AV:L/AC:L/Au:N/C:P/I:N/A:N	3.9	2.9	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
6.2	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	2.5	3.6	Asea Brown Boveri Ltd. (ABB)
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None
5.5	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	1.8	3.6	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2019-19105

CWE-256 Plaintext Storage of a Password

Storing a password in plaintext may result in a system compromise.

Assigned by: cybersecurity@ch.abb.com (Secondary)

CWE-522 Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Assigned by: nvd@nist.gov (Primary)

Products affected by CVE-2019-19105

ABB » Tg/s3.2 Firmware » Version: N/A
cpe:2.3:o:abb:tg\/s3.2_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: ABB » Tg/s3.2 » Version: N/A
Busch-jaeger » 6186/11 Firmware » Version: N/A
cpe:2.3:o:busch-jaeger:6186\/11_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Busch-jaeger » 6186/11 » Version: N/A

Vulnerability Details : CVE-2019-19105

Exploit prediction scoring system (EPSS) score for CVE-2019-19105

CVSS scores for CVE-2019-19105

CWE ids for CVE-2019-19105

References for CVE-2019-19105

Products affected by CVE-2019-19105