CVE-2019-20457

Katalog CVE

CVSS 9.1 · Critical EPSS 0,74%

Kerentanan Incorrect Default Permissions. Skor CVSS 3.1 9.1 (Critical) menurut CISA ADP.

Deskripsi (NVD)

An issue was discovered on Brother MFC-J491DW C1806180757 devices. The printer's web-interface password hash can be retrieved without authentication, because the response header of any failed login attempt returns an incomplete authorization cookie. The value of the authorization cookie is the MD5 hash of the password in hexadecimal. An attacker can easily derive the true MD5 hash from this, and use offline cracking attacks to obtain administrative access to the device.

Rincian

Terbit di NVD

7 November 2024

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

9.1 (Critical), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-276: Incorrect Default Permissions

EPSS (30 hari)

0,74% peluang dieksploitasi; lebih tinggi dari 53,5% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://global.brother
• https://seclists.org/fulldisclosure/2024/Jul/14
• https://support.brother.com/g/s/security/en/index.html
• http://seclists.org/fulldisclosure/2024/Jul/14