Vulnerability in Versa-Networks Versa Analytics
CVE-2019-25030
In Versa Director, Versa Analytics and VOS, Passwords are not hashed using an adaptive cryptographic hash function or key derivation function prior to storage. Popular hashing algorithms based on the Merkle-Damgardconstruction (such as MD5 and SHA-1) alone are insufficient in thwarting password cracking. Attackers can generate and use precomputed hashes for all possible password character combinations (commonly referred to as "rainbow tables") relatively quickly. The use of adaptive hashing algorithms such asscryptorbcryptor Key-Derivation Functions (i.e.PBKDF2) to hash passwords make generation of such rainbow tables computationally infeasible.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.002 (10.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 11th percentile — 10.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000
Affected products
- Versa-Networks Versa Analytics
- Versa-Networks Versa Director
- Versa-Networks Versa Operating System
- Versa Director, Analytics, Vos — versions Fixed Versions: 16.1R2S11, 20.2.2, 21.1.1, 21.2.1
Weakness classification (CWE)
Public proof-of-concept exploits
References
- hackerone.com/reports/1168197 (Third Party Advisory)
Frequently asked questions
- What is CVE-2019-25030?
- CVE-2019-25030 is a medium-severity vulnerability in Versa-Networks Versa Analytics, classified under Insufficiently Protected Credentials. CVSS score: 5.5/10. Published 2021-05-26.
- How severe is CVE-2019-25030?
- Medium severity. CVSS v3 base score is 5.5 out of 10.
- Is CVE-2019-25030 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.