CVEvulnerability
CVE-2019-7666
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2019-07-01
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-287
Description
Prima Systems FlexAir, Versions 2.3.38 and prior. The application allows improper authentication using the MD5 hash value of the password, which may allow an attacker with access to the database to login as admin without decrypting the password.
Affected configurations
• primasystems flexair (<= 2.3.38)
Related
Weakness · CWE (1)
- CWE-287 Improper Authentication weakness
References
- http://packetstormsecurity.com/files/155262/Prima-FlexAir-Access-Control-2.3.35-Database-Backup-Predictable-Name.html Exploit, Third Party Advisory, VDB Entry
- https://applied-risk.com/labs/advisories Third Party Advisory
- https://www.applied-risk.com/resources/ar-2019-007 Third Party Advisory
- https://www.us-cert.gov/ics/advisories/icsa-19-211-02 Third Party Advisory, US Government Resource
- http://packetstormsecurity.com/files/155262/Prima-FlexAir-Access-Control-2.3.35-Database-Backup-Predictable-Name.html Exploit, Third Party Advisory, VDB Entry
- https://applied-risk.com/labs/advisories Third Party Advisory
- https://www.applied-risk.com/resources/ar-2019-007 Third Party Advisory
- https://www.us-cert.gov/ics/advisories/icsa-19-211-02 Third Party Advisory, US Government Resource