PT-2019-16761 · Premisys · Premisys Identicard

Published 2019-01-18 · Updated 2022-12-03 · CVE-2019-3906

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Premisys Identicard version 3.1.190

Description The issue concerns hardcoded credentials in the WCF service on port 9003. An authenticated remote attacker can exploit these credentials to access and modify the badge system database.

Recommendations For Premisys Identicard version 3.1.190, consider changing the hardcoded credentials in the WCF service to prevent unauthorized access. As a temporary workaround, restrict access to the WCF service on port 9003 to minimize the risk of exploitation.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2019-3906

Affected Products

Premisys Identicard

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2019-3906 · Security Note
• https://osv.dev/vulnerability/CVE-2019-3906 · Vendor Advisory
• https://tenable.com/security/research/tra-2019-01 · Note
• http://securityfocus.com/bid/106552 · Note
• https://t.me/cvenotify/39067 · Telegram Post