CVE-2019-3908 Hardcoded credentials in Premisys Identicard 3.1.190
Attackers with access to backup files can decrypt them using a hard-coded password to obtain sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-3908?
CVE-2019-3908 is a high-severity vulnerability in Premisys Identicard 3.1.190, published on 18 Jan 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Premisys Identicard version 3.1.190 stores backup files as encrypted zip files. The password to the zip is hard-coded and unchangeable. An attacker with access to these backups can decrypt them and obtain sensitive data.
Which versions are affected by CVE-2019-3908?
It affects 1 product.
Products include Identicard Premisys Id.
How do I fix CVE-2019-3908?
No fix has been published for CVE-2019-3908 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-3908 being exploited?
There is no known exploitation of CVE-2019-3908 in the wild and no public exploit code.
Other vulnerabilities in Premisys Identicard 3.1.190
Sources
Also known as GHSA-hrx7-7chr-4cvm.