CVE-2019-19885: In Bender COMTRAXX, user authorization is validated for most, but not all, routes in the system. A user with knowledge about the routes can read and write configuration data without prior authoriza...

Summary

In Bender COMTRAXX, user authorization is validated for most, but not all, routes in the system. A user with knowledge about the routes can read and write configuration data without prior authorization. This affects COM465IP, COM465DP, COM465ID, CP700, CP907, and CP915 devices before 4.2.0.

What to do

Update bender com465ip_firmware to version 4.2.0 or later.
Update bender com465dp_firmware to version 4.2.0 or later.
Update bender com465id_firmware to version 4.2.0 or later.
Update bender cp700_firmware to version 4.2.0 or later.
Update bender cp907_firmware to version 4.2.0 or later.
Update bender cp915_firmware to version 4.2.0 or later.

Affected software

Vendor	Product	Affected versions
bender	com465ip_firmware	< 4.2.0 `cpe:2.3:o:bender:com465ip_firmware::::::::`
bender	com465dp_firmware	< 4.2.0 `cpe:2.3:o:bender:com465dp_firmware::::::::`
bender	com465id_firmware	< 4.2.0 `cpe:2.3:o:bender:com465id_firmware::::::::`
bender	cp700_firmware	< 4.2.0 `cpe:2.3:o:bender:cp700_firmware::::::::`
bender	cp907_firmware	< 4.2.0 `cpe:2.3:o:bender:cp907_firmware::::::::`
bender	cp915_firmware	< 4.2.0 `cpe:2.3:o:bender:cp915_firmware::::::::`

Original advisory text

In Bender COMTRAXX, user authorization is validated for most, but not all, routes in the system. A user with knowledge about the routes can read and write configuration data without prior authoriza...

In Bender COMTRAXX, user authorization is validated for most, but not all, routes in the system. A user with knowledge about the routes can read and write configuration data without prior authorization. This affects COM465IP, COM465DP, COM465ID, CP700, CP907, and CP915 devices before 4.2.0.

References

https://cert.vde.com/en-us/advisories/vde-2020-043 Third Party Advisory