CVE-2019-13140

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Inteno EG200 EG200-WU7P1U_ADAMO3.16.4-190226_1650 routers have a JUCI ACL misconfiguration that allows the "user" account to extract the 3DES key via JSON commands to ubus. The 3DES key is used to decrypt the provisioning file provided by Adamo Telecom on a public URL via cleartext HTTP.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-552

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/154494/Inteno-IOPSYS-Gateway-3DES-Key-Extraction-Improper-Access.htmlExploit, Third Party Advisory, VDB Entry
https://twitter.com/GerardFuguet/status/1169298861782896642Third Party Advisory
https://www.exploit-db.com/docs/47397Exploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/47390Exploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/154494/Inteno-IOPSYS-Gateway-3DES-Key-Extraction-Improper-Access.htmlExploit, Third Party Advisory, VDB Entry
https://twitter.com/GerardFuguet/status/1169298861782896642Third Party Advisory
https://www.exploit-db.com/docs/47397Exploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/47390Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Sep 16, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-131425.5The RzSurroundVADStreamingService (RzSurroundVADStreamingService.exe) in Razer Surround 1.1.63.0 runs as the SYSTEM user using an executable CVE-2019-131439.8An HTTP parameter pollution issue was discovered on Shenzhen Dragon Brothers Fingerprint Bluetooth Round Padlock FB50 2.3. With the user ID,CVE-2019-131449.8myTinyTodo 1.3.3 through 1.4.3 allows CSV Injection. This is fixed in 1.5.CVE-2019-131465.3The field_test gem 0.3.0 for Ruby has unvalidated input. A method call that is expected to return a value from a certain set of inputs can b CVE-2019-131476.5In Audio File Library (aka audiofile) 0.3.6, there exists one NULL pointer dereference bug in ulaw2linear_buf in G711.cpp in libmodules.a th CVE-2019-131488.8An issue was discovered in TRENDnet TEW-827DRU firmware before 2.05B11. There is a command injection in apply.cgi (exploitable with authenti CVE-2019-131498.8An issue was discovered in TRENDnet TEW-827DRU firmware before 2.05B11. There is a command injection in apply.cgi (exploitable with authenti CVE-2019-13157.8An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links, aka 'Windows Error Report CVE-2019-131508.8An issue was discovered in TRENDnet TEW-827DRU firmware before 2.05B11. There is a command injection in apply.cgi (exploitable with authenti CVE-2019-131518.8An issue was discovered in TRENDnet TEW-827DRU firmware before 2.05B11. There is a command injection in apply.cgi (exploitable with authenti CVE-2019-131528.8An issue was discovered in TRENDnet TEW-827DRU firmware before 2.05B11. There is a command injection in apply.cgi (exploitable with authenti CVE-2019-131538.8An issue was discovered in TRENDnet TEW-827DRU firmware before 2.05B11. There is a command injection in apply.cgi (exploitable with authenti