CVE-2019-20026
HIGHCVSS 7.5/10EPSS 1.12%
Last modified
CVE-2019-20026 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. The WebPro interface in NEC SV9100 software releases 7.0 or higher allows unauthenticated remote attackers to reset all existing usernames and passwords to default values via a crafted request.. EPSS estimates a 1.12% chance of exploitation in the next 30 days.
Description
The WebPro interface in NEC SV9100 software releases 7.0 or higher allows unauthenticated remote attackers to reset all existing usernames and passwords to default values via a crafted request.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Nec | Sv9100 Firmware | >= 7.0 |
References
- https://shadytel.su/files/nec_cve.txtThird Party Advisory
- https://shadytel.su/files/nec_cve.txtThird Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-20026?
The WebPro interface in NEC SV9100 software releases 7.0 or higher allows unauthenticated remote attackers to reset all existing usernames and passwords to default values via a crafted request.
How severe is CVE-2019-20026?
CVE-2019-20026 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 1.12% probability of exploitation in the next 30 days.
How do I fix CVE-2019-20026?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-20020A stack-based buffer over-read was discovered in ReadNextStr…6.5
- CVE-2019-20021A heap-based buffer over-read was discovered in canUnpack in…5.5
- CVE-2019-20022An invalid memory address dereference was discovered in load…6.5
- CVE-2019-20023A memory leak was discovered in image_buffer_resize in froms…6.5
- CVE-2019-20024A heap-based buffer overflow was discovered in image_buffer_…6.5
- CVE-2019-20025Certain builds of NEC SV9100 software could allow an unauthe…9.8
- CVE-2019-20027Aspire-derived NEC PBXes, including the SV8100, SV9100, SL11…9.8
- CVE-2019-20028Aspire-derived NEC PBXes operating InMail software, includin…7.5
- CVE-2019-20029An exploitable privilege escalation vulnerability exists in …8.8
- CVE-2019-2003In addLinks of Linkify.java, there is a possible phishing ve…
- CVE-2019-20030An attacker with knowledge of the modem access number on a N…7.8
- CVE-2019-20031NEC UM8000, UM4730 and prior non-InMail voicemail systems wi…9.1
Are you affected by CVE-2019-20026?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST