CVE-2019-12777

CVE-2019-12777 describes a critical misconfiguration in ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 devices running specific firmware versions. The vulnerability stems from insecure directory permissions (rwxrwxrwx) granted to all users for /usr/local and its subdirectories, overriding secure defaults. This allows any authenticated user to read, write, and execute files in these critical system locations. Rated with a CVSSv3 score of 7.8 (High), this local vulnerability (AV:L) has low attack complexity (AC:L) and requires low privileges (PR:L), but can lead to high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H). The EPSS score is very low, suggesting minimal exploitability in the wild. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are also minimal, indicating a lack of widespread attention or exploitation.