Computrols Computrols Building Automation Software — known CVE vulnerabilities

Every CVE whose affected-product data names Computrols Computrols Building Automation Software, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (9)

• CVE-2019-10850 — CVSS 9.8 (critical): Computrols CBAS 18.0.0 has Default Credentials.
• CVE-2019-10852 — CVSS 8.8 (high): Computrols CBAS 18.0.0 allows Authenticated Blind SQL Injection via the id GET parameter, as demonstrated by the index.php?m=servers&a=start…
• CVE-2019-10847 — CVSS 8.8 (high): Computrols CBAS 18.0.0 allows Cross-Site Request Forgery.
• CVE-2019-10854 — CVSS 8.8 (high): Computrols CBAS 18.0.0 allows Authenticated Command Injection.
• CVE-2019-10853 — CVSS 8.1 (high): Computrols CBAS 18.0.0 allows Authentication Bypass.
• CVE-2019-10855 — CVSS 7.5 (high): Computrols CBAS 18.0.0 mishandles password hashes. The approach is MD5 with a pw prefix, e.g., if the password is admin, it will calculate…
• CVE-2019-10849 — CVSS 7.5 (high): Computrols CBAS 18.0.0 allows unprotected Subversion (SVN) directory / source code disclosure.
• CVE-2019-10851 — CVSS 6.5 (medium): Computrols CBAS 18.0.0 has hard-coded encryption keys.
• CVE-2019-10848 — CVSS 5.3 (medium): Computrols CBAS 18.0.0 allows Username Enumeration.