CVE-2019-6814 EXPLOIT
9.8
CRITICAL · CVSS 3.1 · EPSS 36.7% (pctl 98)
Patch early
A public exploit exists.
Description
A CWE-287: Improper Authentication vulnerability exists in the NET55XX Encoder with firmware prior to version 2.1.9.7 which could cause impact to confidentiality, integrity, and availability when a remote attacker crafts a malicious request to the encoder webUI.
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 36.65% — more likely to be exploited than 98% of all CVEs |
| Weakness | CWE-287 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2019-05-22 |
| Last modified | 2026-06-17 |
Affected (14)
| Vendor | Product |
|---|---|
| schneider-electric | net5500 |
| schneider-electric | net5500 firmware |
| schneider-electric | net5501 |
| schneider-electric | net5501 firmware |
| schneider-electric | net5501-i |
| schneider-electric | net5501-i firmware |
| schneider-electric | net5501-xt |
| schneider-electric | net5501-xt firmware |
| schneider-electric | net5504 |
| schneider-electric | net5504 firmware |
| schneider-electric | net5508 |
| schneider-electric | net5508 firmware |
| schneider-electric | net5516 |
| schneider-electric | net5516 firmware |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Schneider Electric Pelco Endura NET55XX Encoder - Authentication Bypass (Metasploit) | 2019-07-29 |
References
→ the Explorer · watch your stack · NVD