CVE-2019-13352 - WolfVision Cynap before 1.30j uses a static, hard-coded cryptographic secret for generating support PINs for the 'forgot password' feature

Back Back to CVE browser

CRITICAL

WolfVision Cynap before 1.30j uses a static, hard-coded cryptographic secret for generating support PINs for the 'forgot password' feature

Published Jul 5, 2019

9.8

CRITICAL

CVSS 3.0

EPSS 2.88%

Description

WolfVision Cynap before 1.30j uses a static, hard-coded cryptographic secret for generating support PINs for the 'forgot password' feature. By knowing this static secret and the corresponding algorithm for calculating support PINs, an attacker can reset the ADMIN password and thus gain remote access.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-798

Hard-coded Credentials

References (3)

http://packetstormsecurity.com/files/153530/WolfVision-Cynap-1.18g-1.28j-Hardcoded-Credential.html
x_refsource_MISCExploitThird Party Advisory
http://seclists.org/fulldisclosure/2019/Jul/9
mailing-listx_refsource_FULLDISCExploitThird Party Advisory
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-021.txt
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
http://packetstormsecurity.com/files/153530/WolfVision-Cynap-1.18g-1.28j-Hardcoded-Credential.html		x_refsource_MISCExploitThird Party Advisory
http://seclists.org/fulldisclosure/2019/Jul/9		mailing-listx_refsource_FULLDISCExploitThird Party Advisory
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-021.txt		x_refsource_MISCExploitThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Jul 5, 2019

Updated Aug 4, 2024

Reserved Jul 5, 2019

Link CVE-2019-13352

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2019-13352

Red Hat

Severity n/a

Public date n/a

Links CVE-2019-13352