CVE-2019-6517

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

BD FACSLyric Research Use Only, Windows 10 Professional Operating System, U.S. and Malaysian Releases, between November 2017 and November 2018 and BD FACSLyric IVD Windows 10 Professional Operating System US release does not properly enforce user access control to privileged accounts, which may allow for unauthorized access to administrative level functions.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
ICS-CERT	BD FACSLyric	BD FACSLyric Research Use Only, Windows 10 Professional Operating System, U.S. and Malaysian Releases, between November 2017 and November 2018 and BD FACSLyric IVD Windows 10 Professional Operating System US release.

References

http://www.securityfocus.com/bid/106766Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSMA-19-029-02Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/106766Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSMA-19-029-02Third Party Advisory, US Government Resource

Timeline

Published: Feb 6, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-65187.5Moxa IKS and EDS store plaintext passwords, which may allow sensitive information to be read by someone with access to the device.CVE-2019-65199.8WebAccess/SCADA, Version 8.3. An improper authentication vulnerability exists that could allow a possible authentication bypass allowing an CVE-2019-65207.5Moxa IKS and EDS does not properly check authority on server side, which results in a read-only user being able to perform arbitrary configu CVE-2019-65218.6WebAccess/SCADA, Version 8.3. Specially crafted requests could allow a possible authentication bypass that could allow an attacker to obtain CVE-2019-65229.1Moxa IKS and EDS fails to properly check array bounds which may allow an attacker to read device memory on arbitrary addresses, and may allo CVE-2019-65239.8WebAccess/SCADA, Version 8.3. The software does not properly sanitize its inputs for SQL commands.CVE-2019-65249.8Moxa IKS and EDS do not implement sufficient measures to prevent multiple failed authentication attempts, which may allow an attacker to dis CVE-2019-65258.8AVEVA Wonderware System Platform 2017 Update 2 and prior uses an ArchestrA network user account for authentication of system processes and i CVE-2019-65269.8Moxa IKS-G6824A series Versions 4.5 and prior, EDS-405A series Version 3.8 and prior, EDS-408A series Version 3.8 and prior, and EDS-510A se CVE-2019-65279.8PR100088 Modbus gateway versions prior to Release R02 (or Software Version 1.1.13166) may allow an attacker to be able to change the passwor CVE-2019-65288.8PSI GridConnect GmbH Telecontrol Gateway and Smart Telecontrol Unit family, IEC104 Security Proxy versions Telecontrol Gateway 3G Versions 4 CVE-2019-65294.9An attacker could specially craft an FTP request that could crash the PR100088 Modbus gateway versions prior to release R02 (or Software Ver