Lucene search

TenableCVE-2019-3916

HistoryApr 11, 2019 - 3:29 p.m.

CVE-2019-3916

2019-04-1115:29:00

CWE-425

tenable

web.nvd.nist.gov

verizon

fios

gateway

firmware

information disclosure

vulnerability

cve-2019-3916

nvd

api url

password salt

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.4

Confidence

High

EPSS

0.004

Percentile

73.6%

JSON

Information disclosure vulnerability in Verizon Fios Quantum Gateway (G1100) firmware version 02.01.00.05 allows an remote, unauthenticated attacker to retrieve the value of the password salt by simply requesting an API URL in a web browser (e.g. /api).

Affected configurations

Nvd

Node

verizonfios_quantum_gateway_g1100_firmwareMatch02.01.00.05

AND

verizonfios_quantum_gateway_g1100Match-

VendorProductVersionCPE
verizonfios_quantum_gateway_g1100_firmware02.01.00.05cpe:2.3:o:verizon:fios_quantum_gateway_g1100_firmware:02.01.00.05:*:*:*:*:*:*:*
verizonfios_quantum_gateway_g1100-cpe:2.3:h:verizon:fios_quantum_gateway_g1100:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
verizon	fios_quantum_gateway_g1100_firmware	02.01.00.05	cpe:2.3:o:verizon:fios_quantum_gateway_g1100_firmware:02.01.00.05:::::::*
verizon	fios_quantum_gateway_g1100	-	cpe:2.3:h:verizon:fios_quantum_gateway_g1100:-:::::::*

CNA Affected

[
  {
    "product": "Fios Quantum Gateway (G1100)",
    "vendor": "Verizon",
    "versions": [
      {
        "status": "affected",
        "version": "Firmware version 02.01.00.05"
      }
    ]
  }
]

References

www.tenable.com/security/research/tra-2019-17

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.4

Confidence

High

EPSS

0.004

Percentile

73.6%

JSON

Related for CVE-2019-3916