CVE-2019-6519

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

WebAccess/SCADA, Version 8.3. An improper authentication vulnerability exists that could allow a possible authentication bypass allowing an attacker to upload malicious data.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/106722Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-19-024-01Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/106722Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-19-024-01Third Party Advisory, US Government Resource

Timeline

Published: Feb 5, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-65207.5Moxa IKS and EDS does not properly check authority on server side, which results in a read-only user being able to perform arbitrary configu CVE-2019-65218.6WebAccess/SCADA, Version 8.3. Specially crafted requests could allow a possible authentication bypass that could allow an attacker to obtain CVE-2019-65229.1Moxa IKS and EDS fails to properly check array bounds which may allow an attacker to read device memory on arbitrary addresses, and may allo CVE-2019-65239.8WebAccess/SCADA, Version 8.3. The software does not properly sanitize its inputs for SQL commands.CVE-2019-65249.8Moxa IKS and EDS do not implement sufficient measures to prevent multiple failed authentication attempts, which may allow an attacker to dis CVE-2019-65258.8AVEVA Wonderware System Platform 2017 Update 2 and prior uses an ArchestrA network user account for authentication of system processes and i CVE-2019-65269.8Moxa IKS-G6824A series Versions 4.5 and prior, EDS-405A series Version 3.8 and prior, EDS-408A series Version 3.8 and prior, and EDS-510A se CVE-2019-65279.8PR100088 Modbus gateway versions prior to Release R02 (or Software Version 1.1.13166) may allow an attacker to be able to change the passwor CVE-2019-65288.8PSI GridConnect GmbH Telecontrol Gateway and Smart Telecontrol Unit family, IEC104 Security Proxy versions Telecontrol Gateway 3G Versions 4 CVE-2019-65294.9An attacker could specially craft an FTP request that could crash the PR100088 Modbus gateway versions prior to release R02 (or Software Ver CVE-2019-65307.8Panasonic FPWIN Pro version 7.3.0.0 and prior allows attacker-created project files to be loaded by an authenticated user causing heap-based CVE-2019-65318.1An attacker could retrieve passwords from a HTTP GET request from the Kunbus PR100088 Modbus gateway versions prior to Release R02 (or Softw