Critical severity · published Dec 16, 2020
CVE-2019-14480
AdRem NetCrunch 10.6.0.4587 has an Improper Session Handling vulnerability in the NetCrunch web client, which can lead to an authentication bypass or escalation of privileges
9.8
CVSS
1.1%
EPSS
No
On KEV
Description
AdRem NetCrunch 10.6.0.4587 has an Improper Session Handling vulnerability in the NetCrunch web client, which can lead to an authentication bypass or escalation of privileges.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
Netcrunch · Adremsoft
through 11.0.0.5282 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-14480
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-14480
Exploit
https://compass-security.com/fileadmin/Research/Advisories/2020-14_CSNC-2019-015_AdRem_NetCrunch_Improper_Session_Handling.txt
Product
https://www.adremsoft.com/support/
More from Netcrunch
9.8
CVE-2019-14482
AdRem NetCrunch 10.6.0.4587 has a hardcoded SSL private key vulnerability in the NetCrunch web client
8.8
CVE-2019-14479
AdRem NetCrunch 10.6.0.4587 allows Remote Code Execution
8.8
CVE-2019-14483
AdRem NetCrunch 10.6.0.4587 allows Credentials Disclosure
6.5
CVE-2019-14476
AdRem NetCrunch 10.6.0.4587 has a Server-Side Request Forgery (SSRF) vulnerability in the NetCrunch server
5.5
CVE-2019-14477
AdRem NetCrunch 10.6.0.4587 has Improper Credential Storage since the internal user database is readable by low-privileged users and passwords in the database are weakly encoded…