PT-2019-13285 · Wolfvision · Wolfvision Cynap

Published 2019-07-05 · Updated 2019-07-15 · CVE-2019-13352

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WolfVision Cynap versions prior to 1.30j

Description The issue concerns the use of a static, hard-coded cryptographic secret for generating support PINs in the 'forgot password' feature. An attacker who knows this secret and the corresponding algorithm can reset the ADMIN password, thereby gaining remote access.

Recommendations For versions prior to 1.30j, update to version 1.30j or later to resolve the issue. As a temporary workaround, consider restricting access to the 'forgot password' feature until the update is applied.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2019-13352

Affected Products

Wolfvision Cynap

References · 7

• 🔥 http://seclists.org/fulldisclosure/2019/Jul/9 · Exploit
• 🔥 https://syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-021.txt · Exploit
• 🔥 http://packetstormsecurity.com/files/153530/WolfVision-Cynap-1.18g-1.28j-Hardcoded-Credential.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-13352 · Security Note
• https://osv.dev/vulnerability/CVE-2019-13352 · Vendor Advisory
• https://t.me/defcon_news/18588 · Telegram Post
• https://t.me/cvenotify/266 · Telegram Post