CVE-2019-10855
HIGHComputrols CBAS < 19.0.0 - Inadequate Encryption Strength via MD5 Password Hashing
Title source: llmDescription
Computrols CBAS 18.0.0 mishandles password hashes. The approach is MD5 with a pw prefix, e.g., if the password is admin, it will calculate the MD5 hash of pwadmin and store it in a MySQL database.
References (2)
Core 2
Core References
Third Party Advisory x_refsource_misc
https://applied-risk.com/labs/advisories
Third Party Advisory x_refsource_misc
https://applied-risk.com/index.php/download_file/view/196/165
Scores
CVSS v3
7.5
EPSS
0.0100
EPSS Percentile
58.1%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Details
CWE
CWE-326
Status
published
Products (1)
computrols/computrols_building_automation_software
< 19.0.0
Published
May 23, 2019
Tracked Since
Feb 18, 2026