CVE-2019-15653 - Comba AP2600-I devices through A02,0202N00PD2 are prone to password disclosure via an insecure authentication mechanism

Back Back to CVE browser

HIGH

Comba AP2600-I devices through A02,0202N00PD2 are prone to password disclosure via an insecure authentication mechanism

Published Mar 19, 2020

7.5

HIGH

CVSS 3.1

EPSS 0.83%

Description

Comba AP2600-I devices through A02,0202N00PD2 are prone to password disclosure via an insecure authentication mechanism. The HTML source code of the login page contains values that allow obtaining the username and password. The username are password values are a double md5 of the plaintext real value, i.e., md5(md5(value)).

Affected products

Remediation

No remediation recorded yet.

Weaknesses (3)

CWE-311

Missing Encryption of Sensitive Data

CWE-327

Broken Crypto Algorithm

CWE-522

Insufficiently Protected Credentials

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-6605
Advisory
https://www.comba-telecom.com/en/news
x_refsource_MISCVendor Advisory
https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=26164
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-6605		Advisory
https://www.comba-telecom.com/en/news		x_refsource_MISCVendor Advisory
https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=26164		x_refsource_MISCExploitThird Party Advisory