CVE-2019-15653
Last modified
CVE-2019-15653 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Comba AP2600-I devices through A02,0202N00PD2 are prone to password disclosure via an insecure authentication mechanism. The HTML source code of the login page contains values that allow obtaining the username and password. EPSS estimates a 0.83% chance of exploitation in the next 30 days.
Description
Comba AP2600-I devices through A02,0202N00PD2 are prone to password disclosure via an insecure authentication mechanism. The HTML source code of the login page contains values that allow obtaining the username and password. The username are password values are a double md5 of the plaintext real value, i.e., md5(md5(value)).
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Comba | Ap2600-I - A02 - 0202n00pd2 Firmware | All versions |
References
- https://www.comba-telecom.com/en/newsVendor Advisory
- https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=26164Exploit, Third Party Advisory
- https://www.comba-telecom.com/en/newsVendor Advisory
- https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=26164Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-15653?
How severe is CVE-2019-15653?
How do I fix CVE-2019-15653?
Are you affected by CVE-2019-15653?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST