CVE-2019-15653

Comba AP2600-I devices through A02,0202N00PD2 are prone to password disclosure via an insecure authentication mechanism. The HTML source code of the login page contains values that allow obtaining the username and password. The username are password values are a double md5 of the plaintext real value, i.e., md5(md5(value)).

• CWE-311
• CWE-327
• CWE-522

• https://www.comba-telecom.com/en/newsVendor Advisory
• https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=26164Exploit, Third Party Advisory
• https://www.comba-telecom.com/en/newsVendor Advisory
• https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=26164Exploit, Third Party Advisory

Published

Mar 19, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-15648The insert-or-embed-articulate-content-into-wordpress plugin…
• CVE-2019-15649The insert-or-embed-articulate-content-into-wordpress plugin…
• CVE-2019-1565The PAN-OS external dynamics lists in PAN-OS 7.1.21 and earl…
• CVE-2019-15650The stops-core-theme-and-plugin-updates plugin before 8.0.5 …
• CVE-2019-15651wolfSSL 4.1.0 has a one-byte heap-based buffer over-read in …
• CVE-2019-15652The web interface for NSSLGlobal SatLink VSAT Modem Unit (VM…6.1
• CVE-2019-15654Comba AC2400 devices are prone to password disclosure via a …7.5
• CVE-2019-15655D-Link DSL-2875AL devices through 1.00.05 are prone to passw…7.5
• CVE-2019-15656D-Link DSL-2875AL and DSL-2877AL devices through 1.00.05 are…7.5
• CVE-2019-15657In eslint-utils before 1.4.1, the getStaticValue function ca…
• CVE-2019-15658connect-pg-simple before 6.0.1 allows SQL injection if table…
• CVE-2019-15659The pie-register plugin before 3.1.2 for WordPress has SQL i…