Critical severity · published Jul 5, 2019
CVE-2019-13352
WolfVision Cynap before 1.30j uses a static, hard-coded cryptographic secret for generating support PINs for the 'forgot password' feature
9.8
CVSS
2.9%
EPSS
No
On KEV
Description
WolfVision Cynap before 1.30j uses a static, hard-coded cryptographic secret for generating support PINs for the 'forgot password' feature. By knowing this static secret and the corresponding algorithm for calculating support PINs, an attacker can reset the ADMIN password and thus gain remote access.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.9% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CY
Cynap · Wolfvision
before 1.30j · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-13352
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-13352
Exploit
http://packetstormsecurity.com/files/153530/WolfVision-Cynap-1.18g-1.28j-Hardcoded-Credential.html
Exploit
http://seclists.org/fulldisclosure/2019/Jul/9
Exploit
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-021.txt