What is CVE-2019-9484?

CVE-2019-9484 is a high-severity vulnerability in Carel Pcoweb Card, classified under Missing Authentication for Critical Function. CVSS score: 7.5/10. Published 2019-03-01.

How severe is CVE-2019-9484?

High severity. CVSS v3 base score is 7.5 out of 10.

Auth bypass in Carel Pcoweb Card

CVE-2019-9484

The Glen Dimplex Deutschland GmbH implementation of the Carel pCOWeb configuration tool allows remote attackers to obtain access via an HTTP session on port 10000, as demonstrated by reading the modem password (which is 1234), or reconfiguring "party mode" or "vacation mode."

Vulnerability class: Broken Authentication

EPSS: 0.015 (71.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Weakness classification (CWE)

CWE-306 — Missing Authentication for Critical Function

References

cve@mitre.org (x_refsource_MISC)

Frequently asked questions

What is CVE-2019-9484?: CVE-2019-9484 is a high-severity vulnerability in Carel Pcoweb Card, classified under Missing Authentication for Critical Function. CVSS score: 7.5/10. Published 2019-03-01.
How severe is CVE-2019-9484?: High severity. CVSS v3 base score is 7.5 out of 10.