CVE-2019-3907 Weak cryptography in Premisys Identicard 3.1.190
Premisys Identicard stores credentials using weak MD5 hashing, allowing attackers to potentially recover sensitive user information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-3907?
CVE-2019-3907 is a high-severity vulnerability in Premisys Identicard 3.1.190, published on 18 Jan 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Premisys Identicard version 3.1.190 stores user credentials and other sensitive information with a known weak encryption method (MD5 hash of a salt and password).
Which versions are affected by CVE-2019-3907?
It affects 1 product.
Products include Identicard Premisys Id.
How do I fix CVE-2019-3907?
No fix has been published for CVE-2019-3907 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-3907 being exploited?
There is no known exploitation of CVE-2019-3907 in the wild and no public exploit code.
Other vulnerabilities in Premisys Identicard 3.1.190
Sources
Also known as GHSA-3mm6-hc5r-p5rx.