high8.8Public exploit code
CVE-2019-7666
Prima Systems FlexAir, Versions 2.3.38 and prior.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- FlexAir Access Control 2.3.35 - Authentication Bypass2019-11-12 · webapps · hardware
Impact
Prima Systems FlexAir, Versions 2.3.38 and prior. The application allows improper authentication using the MD5 hash value of the password, which may allow an attacker with access to the database to login as admin without decrypting the password.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Primasystems | Flexair | through 2.3.38 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/155262/Prima-FlexAir-Access-Control-2.3.35-Database-Backup-Predictable-Name.html
- https://applied-risk.com/labs/advisories
- https://www.applied-risk.com/resources/ar-2019-007
- https://www.us-cert.gov/ics/advisories/icsa-19-211-02
- http://packetstormsecurity.com/files/155262/Prima-FlexAir-Access-Control-2.3.35-Database-Backup-Predictable-Name.html
- https://applied-risk.com/labs/advisories
- https://www.applied-risk.com/resources/ar-2019-007
- https://www.us-cert.gov/ics/advisories/icsa-19-211-02