CVE-2019-9861 - Vulnerability Details - OpenCVE

Due to the use of an insecure RFID technology (MIFARE Classic), ABUS proximity chip keys (RFID tokens) of the ABUS Secvest FUAA50000 wireless alarm system can easily be cloned and used to deactivate the alarm system in an unauthorized way.

No CVSS v4.0

No CVSS v3.1

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

Access Vector Adjacent Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Abus	Secvest Wireless Alarm System Fuaa50000 Secvest Wireless Alarm System Fuaa50000 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:abus:secvest_wireless_alarm_system_fuaa50000_firmware:3.01.01:*:*:*:*:*:*:*

cpe:2.3:h:abus:secvest_wireless_alarm_system_fuaa50000:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://packetstormsecurity.com/files/152714/ABUS-Secvest-3.01.01-Cryptographic-Issues.html
http://seclists.org/fulldisclosure/2019/May/3
https://seclists.org/bugtraq/2019/May/1
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-005.txt

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2019-05-14T16:03:38

Updated: 2024-08-04T22:01:55.030Z

Reserved: 2019-03-18T00:00:00

Link: CVE-2019-9861

Vulnrichment

No data.

NVD

Status : Modified

Published: 2019-05-14T17:29:08.397

Modified: 2024-11-21T04:52:27.510

Link: CVE-2019-9861

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2019-05-02T00:00:00", "descriptions": [{"lang": "en", "value": "Due to the use of an insecure RFID technology (MIFARE Classic), ABUS proximity chip keys (RFID tokens) of the ABUS Secvest FUAA50000 wireless alarm system can easily be cloned and used to deactivate the alarm system in an unauthorized way."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-05-14T16:03:38", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-005.txt"}, {"name": "20190503 [SYSS-2019-005]: ABUS Secvest - Proximity Key - Cryptographic Issues (CWE-310)", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "https://seclists.org/bugtraq/2019/May/1"}, {"tags": ["x_refsource_MISC"], "url": "http://packetstormsecurity.com/files/152714/ABUS-Secvest-3.01.01-Cryptographic-Issues.html"}, {"name": "20190504 [SYSS-2019-005]: ABUS Secvest - Proximity Key - Cryptographic Issues (CWE-310)", "tags": ["mailing-list", "x_refsource_FULLDISC"], "url": "http://seclists.org/fulldisclosure/2019/May/3"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2019-9861", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Due to the use of an insecure RFID technology (MIFARE Classic), ABUS proximity chip keys (RFID tokens) of the ABUS Secvest FUAA50000 wireless alarm system can easily be cloned and used to deactivate the alarm system in an unauthorized way."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-005.txt", "refsource": "MISC", "url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-005.txt"}, {"name": "20190503 [SYSS-2019-005]: ABUS Secvest - Proximity Key - Cryptographic Issues (CWE-310)", "refsource": "BUGTRAQ", "url": "https://seclists.org/bugtraq/2019/May/1"}, {"name": "http://packetstormsecurity.com/files/152714/ABUS-Secvest-3.01.01-Cryptographic-Issues.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/152714/ABUS-Secvest-3.01.01-Cryptographic-Issues.html"}, {"name": "20190504 [SYSS-2019-005]: ABUS Secvest - Proximity Key - Cryptographic Issues (CWE-310)", "refsource": "FULLDISC", "url": "http://seclists.org/fulldisclosure/2019/May/3"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T22:01:55.030Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-005.txt"}, {"name": "20190503 [SYSS-2019-005]: ABUS Secvest - Proximity Key - Cryptographic Issues (CWE-310)", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "https://seclists.org/bugtraq/2019/May/1"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://packetstormsecurity.com/files/152714/ABUS-Secvest-3.01.01-Cryptographic-Issues.html"}, {"name": "20190504 [SYSS-2019-005]: ABUS Secvest - Proximity Key - Cryptographic Issues (CWE-310)", "tags": ["mailing-list", "x_refsource_FULLDISC", "x_transferred"], "url": "http://seclists.org/fulldisclosure/2019/May/3"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2019-9861", "datePublished": "2019-05-14T16:03:38", "dateReserved": "2019-03-18T00:00:00", "dateUpdated": "2024-08-04T22:01:55.030Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:abus:secvest_wireless_alarm_system_fuaa50000_firmware:3.01.01:*:*:*:*:*:*:*", "matchCriteriaId": "3C5A31E7-5281-4EDC-9CC5-A887857BB6B7", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:abus:secvest_wireless_alarm_system_fuaa50000:-:*:*:*:*:*:*:*", "matchCriteriaId": "CD534B70-3FA6-4712-A30E-A9BEEB9A91CB", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Due to the use of an insecure RFID technology (MIFARE Classic), ABUS proximity chip keys (RFID tokens) of the ABUS Secvest FUAA50000 wireless alarm system can easily be cloned and used to deactivate the alarm system in an unauthorized way."}, {"lang": "es", "value": "Producto del uso de una tecnolog\u00eda RFID no segura (MIFARE Classic), las claves de chip de proximidad ABUS (tokens RFID) del sistema de alarma inalambrico de ABUS Secvest FUAA50000 pueden clonarse f\u00e1cilmente y utilizarse para desactivar el sistema de alarma de forma no autorizada."}], "id": "CVE-2019-9861", "lastModified": "2024-11-21T04:52:27.510", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:A/AC:L/Au:N/C:P/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.5, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-05-14T17:29:08.397", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/152714/ABUS-Secvest-3.01.01-Cryptographic-Issues.html"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "url": "http://seclists.org/fulldisclosure/2019/May/3"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "url": "https://seclists.org/bugtraq/2019/May/1"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-005.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/152714/ABUS-Secvest-3.01.01-Cryptographic-Issues.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "url": "http://seclists.org/fulldisclosure/2019/May/3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "url": "https://seclists.org/bugtraq/2019/May/1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-005.txt"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-310"}], "source": "nvd@nist.gov", "type": "Primary"}]}