PT-2019-18689 · Prima Systems · Flexair

Published 2019-07-01 · Updated 2022-10-25 · CVE-2019-7666

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Prima Systems FlexAir versions 2.3.38 and prior

Description The issue allows for improper authentication using the MD5 hash value of the password, potentially enabling an attacker with database access to login as admin without decrypting the password.

Recommendations For versions 2.3.38 and prior, consider updating to a version that uses a more secure authentication mechanism, such as one that does not rely on the MD5 hash value of the password. As a temporary workaround, restrict access to the database to minimize the risk of exploitation.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2019-7666

Affected Products

Flexair

References · 7

• 🔥 http://packetstormsecurity.com/files/155262/Prima-FlexAir-Access-Control-2.3.35-Database-Backup-Predictable-Name.html · Exploit
• 🔥 https://exploit-db.com/exploits/47644 · Exploit
• https://osv.dev/vulnerability/CVE-2019-7666 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-7666 · Security Note
• https://applied-risk.com/resources/ar-2019-007 · Note
• https://us-cert.gov/ics/advisories/icsa-19-211-02 · Note
• https://applied-risk.com/labs/advisories · Note