CVE-2019-19751
Published: 30 April 2024
Summary
CVE-2019-19751 is a medium-severity Channel Accessible by Non-Endpoint (CWE-300) vulnerability in Easymine (inferred from references). Its CVSS base score is 5.6 (Medium).
Operationally, ranked at the 31.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-9351
Vulnerability details
easyMINE before 2019-12-05 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Ensures only authenticated endpoints can access the communication channel, blocking unauthorized non-endpoint access.
Physically restricts transmission channels so they cannot be accessed or tapped by non-endpoint actors within facilities.
Periodic TSCM surveys identify unauthorized access points or taps that make communication channels reachable by non-endpoint adversaries.
Explicitly isolates the communications path so it cannot be accessed or intercepted by non-endpoint entities during security functions.
Restrictions and channel controls reduce the chance that VoIP media or signaling streams remain accessible to non-participants.
Directly prevents non-endpoint access or interception of the session communication path.
An out-of-band channel is inaccessible to non-endpoints that can observe or interfere with the primary communication channel.
The control restricts an inherently broadcast wireless channel to only intended endpoints, mitigating accessibility by non-endpoints.