CVE-2019-13400 Information disclosure in n/a
Attackers can retrieve administrative credentials in cleartext from a CGI endpoint, leading to unauthorized access to the device.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-13400?
CVE-2019-13400 is a critical vulnerability in n/a, published on 8 Jul 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Dynacolor FCM-MB40 v1.2.0.0 use /etc/appWeb/appweb.pass to store administrative web-interface credentials in cleartext. These credentials can be retrieved via cgi-bin/getuserinfo.cgi?mode=info.
Weakness: CWE-522
Which versions are affected by CVE-2019-13400?
It affects 1 product.
Products include Fortinet Fcm-Mb40 Firmware.
How do I fix CVE-2019-13400?
No fix has been published for CVE-2019-13400 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-13400 being exploited?
There is no known exploitation of CVE-2019-13400 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-php7-2p2p-vjgj.