Comba AP2600-I devices through A02,0202N00PD2 are prone... · CVE-2019-15654 · GitHub Advisory Database · GitHub

Comba AP2600-I devices through A02,0202N00PD2 are prone...

Moderate severity Unreviewed Published May 24, 2022 to the GitHub Advisory Database • Updated Feb 11, 2023

Package

No package listed— Suggest a package

Affected versions

Unknown

Patched versions

Unknown

Description

Comba AP2600-I devices through A02,0202N00PD2 are prone to password disclosure via a simple crafted /09/business/upgrade/upcfgAction.php?download=true request to the web management server. The request doesn't require any authentication and will lead to saving the DBconfig.cfg file. At the end of the file, the login information is stored in cleartext.

References

Published by the National Vulnerability Database

Mar 19, 2020

Published to the GitHub Advisory Database May 24, 2022

Last updated Feb 11, 2023

Weaknesses

CWE-306

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. Learn more on MITRE.

CWE-522

Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. Learn more on MITRE.