PT-2019-13285 · Wolfvision · Wolfvision Cynap

Publicado 2019-07-05 · Atualizado 2019-07-15 · CVE-2019-13352

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WolfVision Cynap versions prior to 1.30j

Description The issue concerns the use of a static, hard-coded cryptographic secret for generating support PINs in the 'forgot password' feature. An attacker who knows this secret and the corresponding algorithm can reset the ADMIN password, thereby gaining remote access.

Recommendations For versions prior to 1.30j, update to version 1.30j or later to resolve the issue. As a temporary workaround, consider restricting access to the 'forgot password' feature until the update is applied.

Exploit

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2019-13352

Produtos afetados

Wolfvision Cynap

Referências · 7

• 🔥 http://seclists.org/fulldisclosure/2019/Jul/9 · Exploit
• 🔥 https://syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-021.txt · Exploit
• 🔥 http://packetstormsecurity.com/files/153530/WolfVision-Cynap-1.18g-1.28j-Hardcoded-Credential.html · Exploit
• https://t.me/defcon_news/18588 · Publicação no Telegram
• https://t.me/cvenotify/266 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2019-13352 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-13352 · Aviso do Fabricante