PT-2020-9751 · Comba · Comba Ap2600-I

Published 2020-03-19 · Updated 2021-07-21 · CVE-2019-15653

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Comba AP2600-I devices through A02,0202N00PD2

Description The issue allows for password disclosure due to an insecure authentication mechanism. The HTML source code of the login page contains values that can be used to obtain the username and password. These values are a double MD5 hash of the plaintext real value, calculated as md5(md5(value)).

Recommendations For Comba AP2600-I devices through A02,0202N00PD2, consider changing the authentication mechanism to a more secure method to prevent password disclosure. As a temporary workaround, restrict access to the login page to minimize the risk of exploitation.

Exploit

Fix

Missing Encryption of Sensitive Data

Insufficiently Protected Credentials

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-311

CWE-522

CWE-327

Related Identifiers

CVE-2019-15653

Affected Products

Comba Ap2600-I

References · 3

• 🔥 https://trustwave.com/en-us/resources/security-resources/security-advisories/?fid=26164 · Exploit
• https://comba-telecom.com/en/news · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-15653 · Security Note