PT-2019-16763 · Premisys · Premisys Identicard

Published 2019-01-18 · Updated 2022-12-03 · CVE-2019-3908

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Premisys Identicard version 3.1.190

Description The issue concerns the storage of backup files as encrypted zip files with a hard-coded and unchangeable password. This allows an attacker with access to these backups to decrypt them and obtain sensitive data.

Recommendations For Premisys Identicard version 3.1.190, consider changing the backup storage mechanism to one that uses a secure, user-defined password or encryption key, and ensure that access to backups is strictly controlled. As a temporary workaround, restrict access to the backup files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

CWE-259

Related Identifiers

CVE-2019-3908

Affected Products

Premisys Identicard

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-3908 · Security Note
• https://osv.dev/vulnerability/CVE-2019-3908 · Vendor Advisory
• http://securityfocus.com/bid/106552 · Note
• https://tenable.com/security/research/tra-2019-01 · Note