title: TECSON/GOK: Improper Authentication and Access Control on multiple devices
description: In multiple Tecson Tankspion and GOKs SmartBox 4 products the affected application doesn't properly restrict access to an endpoint that is responsible for saving settings, to a unauthenticated user with limited access rights. Based on the lack of adequately implemented access-control rules, by accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to change the application settings without authenticating at all, which violates originally laid ACL rules.
problem types: CWE-287 Improper Authentication
affected:
{
product: e-litro net
vendor: TECSON
versions:
lessThan: V6.32, status: affected, version: unspecified, versionType: custom
}
{
product: LX-Net
vendor: TECSON
versions:
lessThan: V6.32, status: affected, version: unspecified, versionType: custom
}
{
product: LX-Q-Net
vendor: TECSON
versions:
lessThan: V6.32, status: affected, version: unspecified, versionType: custom
}
{
product: SmartBox 4 LAN
vendor: GOK
versions:
lessThan: V6.3, status: affected, version: unspecified, versionType: custom
}
{
product: SmartBox 4 LAN PRO
vendor: GOK
versions:
lessThan: V6.3, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
solutions: Upgrade to firmware version > 6.32