CWE Code: 269
Vulnerability Type: privilege_escalation
CVSS Score: 6.5
CWE Name:  Improper Privilege Management
Summary: an issue was discovered on topcon positioning net-g5 gnss receiver devices with firmware 5.2.2. the web interface of the product is protected by a login. a guest is allowed to login. once logged in as a guest, an attacker can browse a url to read the password of the administrative user. the same procedure allows a regular user to gain administrative privileges. the guest login is possible in the default configuration.
Access Authentication: SINGLE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2019-09-20
Last Modified Date: 2019-09-23