CVE-2019-15653 Information disclosure in n/a
Attackers can obtain administrator credentials by extracting double-MD5 hashed values from the login page source code of Comba AP2600-I devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-15653?
CVE-2019-15653 is a high-severity vulnerability in n/a, published on 19 Mar 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Comba AP2600-I devices through A02,0202N00PD2 are prone to password disclosure via an insecure authentication mechanism. The HTML source code of the login page contains values that allow obtaining the username and password. The username are password values are a double md5 of the plaintext real value, i.e., md5(md5(value)).
Which versions are affected by CVE-2019-15653?
It affects 1 product.
Products include Comba Ap2600-I - A02 - 0202n00pd2 Firmware.
How do I fix CVE-2019-15653?
No fix has been published for CVE-2019-15653 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-15653 being exploited?
There is no known exploitation of CVE-2019-15653 in the wild and no public exploit code.
Sources
Also known as GHSA-53vv-rvmf-598x.