ID:5847 - Exploit for Information disclosure in Enterprise Building Management System and Proton Building Management System - CVE-2019-7272

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to username disclosure via its username reset functionality. A remote attacker can enumerate and disclose all the valid users on the system.

Furthermore, when calling a certain page from a remote location, the following internal information can be divulged for the current system: Name, Internal IP Address, Netmask, Hostname, Gateway, DNS Server, and DNS Server 2.

Remediation