CVE-2019-3915 Auth bypass in Fios Quantum Gateway (G1100)
An attacker with adjacent network access can replay login requests to bypass authentication and access the administrative interface of the Verizon Fios Quantum Gateway.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-3915?
CVE-2019-3915 is a high-severity authentication bypass vulnerability in Verizon Fios Quantum Gateway (G1100), published on 11 Apr 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Authentication Bypass by Capture-replay vulnerability in Verizon Fios Quantum Gateway (G1100) firmware version 02.01.00.05 allows an unauthenticated attacker with adjacent network access to intercept and replay login requests to gain access to the administrative web interface.
Weakness: CWE-294
Which versions are affected by CVE-2019-3915?
It affects 1 product.
Products include Verizon Fios Quantum Gateway G1100 Firmware.
How do I fix CVE-2019-3915?
No fix has been published for CVE-2019-3915 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2019-3915 being exploited?
There is no known exploitation of CVE-2019-3915 in the wild and no public exploit code.
Other vulnerabilities in Verizon Fios Quantum Gateway (G1100)
Sources
Also known as GHSA-mv24-4hc4-j3rr.