CVE-2019-3908

Premisys Identicard version 3.1.190 stores backup files as encrypted zip files. The password to the zip is hard-coded and unchangeable. An attacker with access to these backups can decrypt them and obtain sensitive data.

Score

CVSS 3.1 7.5 High

Status

Modified - vulnreport@tenable.com

Published

2019-01-18

Last modified

2024-08-04

Weaknesses

CWE-259, CWE-798

Affected products

• Premisys Id (Identicard)

References

• http://www.securityfocus.com/bid/106552
• https://www.tenable.com/security/research/tra-2019-01