CVE-2019-25030 Weak cryptography in Versa Director, Versa Analytics, Versa VOS
Attackers can crack stored passwords using rainbow tables due to weak hashing algorithms in Versa Director, Analytics, and VOS.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-25030?
CVE-2019-25030 is a medium-severity vulnerability in Versa Director, Versa Analytics, Versa VOS, published on 26 May 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In Versa Director, Versa Analytics and VOS, Passwords are not hashed using an adaptive cryptographic hash function or key derivation function prior to storage. Popular hashing algorithms based on the Merkle-Damgardconstruction (such as MD5 and SHA-1) alone are insufficient in thwarting password cracking. Attackers can generate and use precomputed hashes for all possible password character combinations (commonly referred to as "rainbow tables") relatively quickly. The use of adaptive hashing algorithms such asscryptorbcryptor Key-Derivation Functions (i.e.PBKDF2) to hash passwords make generation of such rainbow tables computationally infeasible.
Weakness: CWE-522
Which versions are affected by CVE-2019-25030?
It affects 3 products.
Products include Versa-Networks Versa Analytics, Versa-Networks Versa Director, Versa-Networks Versa Operating System.
How do I fix CVE-2019-25030?
No fix has been published for CVE-2019-25030 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-25030 being exploited?
There is no known exploitation of CVE-2019-25030 in the wild and no public exploit code.
Other vulnerabilities in Versa Director, Versa Analytics, Versa VOS
Sources
Also known as GHSA-h5c5-mmgx-53h5.