CVE-2019-6548 Hardcoded credentials in GE Communicator

What is CVE-2019-6548?

CVE-2019-6548 is a critical vulnerability in GE Communicator, published on 9 May 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

GE Communicator, all versions prior to 4.0.517, contains two backdoor accounts with hardcoded credentials, which may allow control over the database. This service is inaccessible to attackers if Windows default firewall settings are used by the end user.

Weakness: CWE-798

Which versions are affected by CVE-2019-6548?

It affects 1 product.

Products include Ge Ge Communicator.

How do I fix CVE-2019-6548?

No fix has been published for CVE-2019-6548 yet. Limit exposure of the affected software until one is available.

Is CVE-2019-6548 being exploited?

There is no known exploitation of CVE-2019-6548 in the wild and no public exploit code.

Other vulnerabilities in GE Communicator

• CVE-2019-6546 Path traversal in GE Communicator High 7.8
• CVE-2019-6564 Privilege escalation in GE Communicator High 7.8
• CVE-2019-6566 Privilege escalation in GE Communicator High 7.8
• CVE-2017-7908 Memory corruption in GE Communicator High 7.6
• CVE-2019-6544 Privilege escalation in GE Communicator Medium 5.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-w27f-jh8g-p7vw.