CVE-2019-15654

Comba AC2400 devices are prone to password disclosure via a simple crafted /09/business/upgrade/upcfgAction.php?download=true request to the web management server. The request doesn't require any authentication and will lead to saving the DBconfig.cfg file. At the end of the file, the login information is stored in cleartext.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://www.comba-telecom.com/en/news	Vendor Advisory
https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=26164	Exploit Third Party Advisory
https://www.comba-telecom.com/en/news	Vendor Advisory
https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=26164	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:comba:ac2400_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:comba:ac2400:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2020-03-19 18:15

Updated : 2024-11-21 04:29

NVD link : CVE-2019-15654

Mitre link : CVE-2019-15654

CVE.ORG link : CVE-2019-15654

JSON object : View

Products Affected

comba

ac2400_firmware
ac2400

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2019-15654", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2020-03-19T18:15:13.740", "references": [{"url": "https://www.comba-telecom.com/en/news", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=26164", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.comba-telecom.com/en/news", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=26164", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "Comba AC2400 devices are prone to password disclosure via a simple crafted /09/business/upgrade/upcfgAction.php?download=true request to the web management server. The request doesn't require any authentication and will lead to saving the DBconfig.cfg file. At the end of the file, the login information is stored in cleartext."}, {"lang": "es", "value": "Los dispositivos Comba AC2400 son propensos a la revelaci\u00f3n de password mediante una solicitud simple manual para la web de la direcci\u00f3n /09/business/upgrade/upcfgAction.php?download=true. Esta solicitud no requiere ninguna autenticaci\u00f3n y conlleva a guardar el archivo DBconfig.cfg. Al final de el archivo, la informaci\u00f3n del login est\u00e1 almacenada en cleartext."}], "lastModified": "2024-11-21T04:29:12.750", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:comba:ac2400_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6F83368F-F0B5-4D76-9824-BD89C4BDEB1D"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:comba:ac2400:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "29367685-618D-4903-A228-A0D48FBCC874"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}