CVE-2019-3916 Information disclosure in Fios Quantum Gateway (G1100)
Remote unauthenticated attackers can retrieve the password salt from Verizon Fios Quantum Gateway firmware via an exposed API endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-3916?
CVE-2019-3916 is a high-severity vulnerability in Verizon Fios Quantum Gateway (G1100), published on 11 Apr 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Information disclosure vulnerability in Verizon Fios Quantum Gateway (G1100) firmware version 02.01.00.05 allows an remote, unauthenticated attacker to retrieve the value of the password salt by simply requesting an API URL in a web browser (e.g. /api).
Weakness: CWE-425
Which versions are affected by CVE-2019-3916?
It affects 1 product.
Products include Verizon Fios Quantum Gateway G1100 Firmware.
How do I fix CVE-2019-3916?
No fix has been published for CVE-2019-3916 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-3916 being exploited?
There is no known exploitation of CVE-2019-3916 in the wild and no public exploit code.
Other vulnerabilities in Verizon Fios Quantum Gateway (G1100)
Sources
Also known as GHSA-p5fq-87jh-gjq8.