PT-2019-6116 · Signalwire+1 · Freeswitch+1

Publicado 2019-12-02 · Atualizado 2020-02-21 · CVE-2019-19492

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FreeSWITCH versions 1.6.10 through 1.10.1

Description The issue is related to the use of default credentials in the event socket.conf.xml configuration file. This could allow a remote attacker to gain full control over the system.

Recommendations For FreeSWITCH versions 1.6.10 through 1.10.1, change the default password in the event socket.conf.xml file to prevent unauthorized access. As a temporary workaround, consider restricting access to the event socket.conf.xml file until the issue is resolved.

Exploit

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

ALT-PU-2020-1199

ALT-PU-2020-1318

BDU:2021-05742

CVE-2019-19492

Produtos afetados

Alt Linux

Freeswitch

Referências · 11

• 🔥 https://github.com/Chocapikk/CVE-2019-19492 · Exploit
• 🔥 https://exploit-db.com/exploits/47698 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-19492 · Nota de Segurança
• https://bdu.fstec.ru/vul/2021-05742 · Nota de Segurança
• https://packages.altlinux.org/ru/vuln/CVE-2019-19492 · Nota
• https://us-cert.cisa.gov/ics/advisories/icsa-21-301-01 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19492 · Nota de Segurança
• https://cybersecurity-help.cz/vdb/SB2021102908 · Nota
• https://errata.altlinux.org/ALT-PU-2020-1318 · Aviso do Fabricante
• https://errata.altlinux.org/ALT-PU-2020-1199 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-19492 · Aviso do Fabricante