CVE-2019-6558 – This vulnerability allows attackers to reset or... (How to Fix)

Q: What is the severity of CVE-2019-6558?

CVE-2019-6558 has a CVSS score of 7.5 (HIGH). This vulnerability allows attackers to reset or change passwords without proper authentication in Auto-Maskin marine control systems and Android app. Affected users include operators of RP210E, DCU210E, and Marine Observer Pro software who haven't updated beyond vulnerable versions.

📋 TL;DR

This vulnerability allows attackers to reset or change passwords without proper authentication in Auto-Maskin marine control systems and Android app. Affected users include operators of RP210E, DCU210E, and Marine Observer Pro software who haven't updated beyond vulnerable versions.

💻 Affected Systems

Products:

Auto-Maskin RP210E
Auto-Maskin DCU210E
Marine Observer Pro (Android App)

Versions: 3.7 and prior

Operating Systems: Android, Embedded systems

Default Config Vulnerable: ⚠️ Yes

Notes: Marine control systems typically operate in isolated networks but may have remote access capabilities.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Unauthorized access to marine control systems could lead to manipulation of vessel operations, safety system bypass, or denial of service affecting navigation and critical functions.

🟠

Likely Case

Attackers gain unauthorized access to control interfaces, potentially viewing sensitive data or making unauthorized configuration changes.

🟢

If Mitigated

With proper network segmentation and access controls, impact limited to isolated systems with no critical function compromise.

🌐 Internet-Facing: MEDIUM

🏢 Internal Only: HIGH

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Weak password recovery mechanism suggests straightforward exploitation without special tools.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Versions after 3.7

Vendor Advisory: https://www.us-cert.gov/ics/advisories/icsa-20-051-04

Restart Required: Yes

Instructions:

1. Contact Auto-Maskin for updated firmware/software. 2. Apply updates to RP210E/DCU210E devices. 3. Update Marine Observer Pro app from Google Play Store. 4. Restart affected systems.

🔧 Temporary Workarounds

Network segmentation

all

Isolate affected systems from untrusted networks

Access control restrictions

all

Implement strict firewall rules and VPN requirements for remote access

🧯 If You Can't Patch

Implement multi-factor authentication for all access to affected systems
Monitor authentication logs for unauthorized password reset attempts

🔍 How to Verify

Check if Vulnerable:

Check device firmware version in system settings or contact Auto-Maskin support

Check Version:

Check device display or configuration interface for firmware version

Verify Fix Applied:

Confirm version is above 3.7 and test password recovery functionality requires proper authentication

📡 Detection & Monitoring

Log Indicators:

Multiple failed login attempts followed by password reset
Password reset requests from unusual IP addresses

Network Indicators:

Unusual authentication traffic patterns
Password reset API calls without preceding failed logins

SIEM Query:

source="marine_control" AND (event_type="password_reset" OR event_type="authentication_failure")

📊 Metadata

CVE ID: CVE-2019-6558

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE: CWE-521

Published: March 23, 2020

Last Updated: November 21, 2024

🔗 References

https://www.us-cert.gov/ics/advisories/icsa-20-051-04 Third Party Advisory,US Government Resource
https://www.us-cert.gov/ics/advisories/icsa-20-051-04 Third Party Advisory,US Government Resource

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2019-6558, you might also want to check these: