CVE-2019-13352

Published: Jul 5, 2019Modified: Jun 17, 2026

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

WolfVision Cynap before 1.30j uses a static, hard-coded cryptographic secret for generating support PINs for the 'forgot password' feature. By knowing this static secret and the corresponding algorithm for calculating support PINs, an attacker can reset the ADMIN password and thus gain remote access.

Affected (1)

Products: Wolfvision: Cynap

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Wolfvision Cynap	Before 1.30j

Related CWEs

Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.

References (6)

http://packetstormsecurity.com/files/153530/WolfVision-Cynap-1.18g-1.28j-Hardcoded-Credential.html

Source: cve@mitre.org

ExploitThird Party Advisory

http://seclists.org/fulldisclosure/2019/Jul/9

Source: cve@mitre.org

ExploitThird Party Advisory

https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-021.txt

Source: cve@mitre.org

ExploitThird Party Advisory

http://packetstormsecurity.com/files/153530/WolfVision-Cynap-1.18g-1.28j-Hardcoded-Credential.html

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

http://seclists.org/fulldisclosure/2019/Jul/9

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-021.txt

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.