{"api_version":"1","generated_at":"2026-07-23T10:16:23+00:00","cve":"CVE-2019-9105","urls":{"html":"https://cve.report/CVE-2019-9105","api":"https://cve.report/api/cve/CVE-2019-9105.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2019-9105","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-9105"},"summary":{"title":"CVE-2019-9105","description":"The WebApp v04.68 in the supervisor on SAET Impianti Speciali TEBE Small 05.01 build 1137 devices allows remote attackers to make several types of API calls without authentication, as demonstrated by retrieving password hashes via an inc/utils/REST_API.php?command=CallAPI&customurl=alladminusers call.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2019-05-31 22:29:00","updated_at":"2021-07-21 11:39:00"},"problem_types":["CWE-306"],"metrics":[],"references":[{"url":"https://www.saet.org/wp-content/uploads/2017/04/Depliant_TEBE-TEBE_Small.pdf","name":"https://www.saet.org/wp-content/uploads/2017/04/Depliant_TEBE-TEBE_Small.pdf","refsource":"MISC","tags":["Product","Vendor Advisory"],"title":"","mime":"application/pdf","httpstatus":"200","archivestatus":"200"},{"url":"https://members.backbox.org/saet-tebe-small-supervisor-multiple-vulnerabilities/","name":"https://members.backbox.org/saet-tebe-small-supervisor-multiple-vulnerabilities/","refsource":"MISC","tags":["Exploit","Third Party Advisory"],"title":"SAET TEBE Small Supervisor, Multiple Vulnerabilities - BackBox.org Membership","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-9105","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9105","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2019","cve_id":"9105","vulnerable":"-1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"h","cpe4":"saet","cpe5":"tebe_small","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"9105","vulnerable":"0","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"h","cpe4":"saet","cpe5":"tebe_small","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"9105","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"saet","cpe5":"tebe_small_firmware","cpe6":"05.01","cpe7":"1137","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"9105","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"saet","cpe5":"tebe_small_firmware","cpe6":"05.01","cpe7":"1137","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"9105","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"saet","cpe5":"webapp","cpe6":"04.68","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"9105","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"saet","cpe5":"webapp","cpe6":"04.68","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2019-9105","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The WebApp v04.68 in the supervisor on SAET Impianti Speciali TEBE Small 05.01 build 1137 devices allows remote attackers to make several types of API calls without authentication, as demonstrated by retrieving password hashes via an inc/utils/REST_API.php?command=CallAPI&customurl=alladminusers call."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"url":"https://www.saet.org/wp-content/uploads/2017/04/Depliant_TEBE-TEBE_Small.pdf","refsource":"MISC","name":"https://www.saet.org/wp-content/uploads/2017/04/Depliant_TEBE-TEBE_Small.pdf"},{"url":"https://members.backbox.org/saet-tebe-small-supervisor-multiple-vulnerabilities/","refsource":"MISC","name":"https://members.backbox.org/saet-tebe-small-supervisor-multiple-vulnerabilities/"}]}},"nvd":{"publishedDate":"2019-05-31 22:29:00","lastModifiedDate":"2021-07-21 11:39:00","problem_types":["CWE-306"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":5},"severity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"AND","children":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:saet:tebe_small_firmware:05.01:1137:*:*:*:*:*:*","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":false,"cpe23Uri":"cpe:2.3:h:saet:tebe_small:-:*:*:*:*:*:*:*","cpe_name":[]}]}],"cpe_match":[]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:saet:webapp:04.68:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2019","CveId":"9105","Ordinal":"146957","Title":"CVE-2019-9105","CVE":"CVE-2019-9105","Year":"2019"},"notes":[{"CveYear":"2019","CveId":"9105","Ordinal":"1","NoteData":"The WebApp v04.68 in the supervisor on SAET Impianti Speciali TEBE Small 05.01 build 1137 devices allows remote attackers to make several types of API calls without authentication, as demonstrated by retrieving password hashes via an inc/utils/REST_API.php?command=CallAPI&customurl=alladminusers call.","Type":"Description","Title":null},{"CveYear":"2019","CveId":"9105","Ordinal":"2","NoteData":"2019-05-31","Type":"Other","Title":"Published"},{"CveYear":"2019","CveId":"9105","Ordinal":"3","NoteData":"2019-05-31","Type":"Other","Title":"Modified"}]}}}