CVE-2019-9534 - CVE House
Back to Database
Status published High CVE-2019-9534

The Cobham EXPLORER 710, firmware version 1.07, does not validate its firmware image

Vulnerability Description

The Cobham EXPLORER 710, firmware version 1.07, does not validate its firmware image. Development scripts left in the firmware can be used to upload a custom firmware image that the device runs. This could allow an unauthenticated, local attacker to upload their own firmware that could be used to intercept or modify traffic, spoof or intercept GPS traffic, exfiltrate private data, hide a backdoor, or cause a denial-of-service.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-9534

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • This issue was found by Kyle O'Meara and David Belasco.

References

More from Cobham plc

View All →
CVE-2019-9533
The root password of the Cobham EXPLORER 710 is the same for all versions of firmware up to and including v1.08
Critical 9.8
CVE-2019-9532
The web application portal of the Cobham EXPLORER 710, firmware version 1.07, sends the login password in cleartext
High 7.8
CVE-2019-9531
The web application portal of the Cobham EXPLORER 710, firmware version 1.07, allows unauthenticated access to a port that can run AT commands
Critical 9.8
CVE-2019-9530
The web root directory of the Cobham EXPLORER 710, firmware version 1.07, has no access restrictions on downloading and reading all files
Medium 5.5
CVE-2019-9529
The web application portal of the Cobham EXPLORER 710, firmware version 1.07, has no authentication by default
Medium 5.5

Affected Vendor

Affected Software

Explorer 710
Vulnerable Versions:
1.07

Timeline

Official Publish: October 10th, 2019
Last Modified: September 17th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-494

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.