Improper Authentication in Valleylab LS10 Energy Platform and Valleylab FT10 Energy Platform - CVE-2019-13531
Published: November 11, 2019
Vulnerability identifier: #VU22637
CSH Severity: Low
CVSS v4: 4.3 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-13531
CWE-ID: CWE-287
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local attacker to bypass authentication process.
The vulnerability exists due to an error in the RFID security mechanism used for authentication between the FT10/LS10 Energy Platform and instruments. An attacker with physical access to the device can connect inauthentic instruments to the generator, bypass authentication process and gain unauthorized access to the application.
Affected software
Valleylab LS10 Energy Platform
Valleylab FT10 Energy Platform
Amazon Linux AMI
Gentoo Linux
Opensuse
Valleylab FT10 Energy Platform
Amazon Linux AMI
Gentoo Linux
Opensuse
How to mitigate CVE-2019-13531
Install updates from vendor's website.