PT-2019-16025
CVE-2019-19967
·
تاريخ النشر
2019-12-25
·
تاريخ التحديث
2020-01-08
الوصف من
CVSS 3.1
7.5
عاليةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions
Connect Box EuroDOCSIS 3.0 Voice Gateway CH7465LG-NCIP version 6.12.18.25-2p6-NOSH
Description
The Administration page on the device accepts a cleartext password in a POST request on port 80, specifically to the "xml/setter.xml" URI. This issue allows for the submission of passwords without encryption.
Recommendations
For version 6.12.18.25-2p6-NOSH, as a temporary workaround, consider restricting access to the Administration page until a patch is available. Avoid using the cleartext password field in the POST request to the "xml/setter.xml" URI until the issue is resolved.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾