Use of hard-coded credentials in freeswitch - CVE-2019-19492
Published: October 29, 2021 / Updated: December 19, 2023
Vulnerability identifier: #VU57782
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-19492
CWE-ID: CWE-798
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote attacker to gain full access to vulnerable system.
The vulnerability exists due to presence of hard-coded credentials in event_socket.conf.xml. A remote unauthenticated attacker can access the affected system using the hard-coded credentials.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
freeswitch
American Dynamics victor Video Management System
American Dynamics victor Video Management System
How to mitigate CVE-2019-19492
Install updates from vendor's website.
freeswitch - update to 1.10.2
American Dynamics victor Video Management System - update to 5.7.1
American Dynamics victor Video Management System - update to 5.7.1