CVE-2019-3906

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Premisys Identicard version 3.1.190 contains hardcoded credentials in the WCF service on port 9003. An authenticated remote attacker can use these credentials to access the badge system database and modify its contents.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-798

Affected software

Vendor	Product	Versions
n/a	Premisys Identicard 3.1.190	Premisys Identicard 3.1.190

References

http://www.securityfocus.com/bid/106552Third Party Advisory, VDB Entry
https://www.tenable.com/security/research/tra-2019-01Third Party Advisory
http://www.securityfocus.com/bid/106552Third Party Advisory, VDB Entry
https://www.tenable.com/security/research/tra-2019-01Third Party Advisory

Timeline

Published: Jan 18, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-39077.5Premisys Identicard version 3.1.190 stores user credentials and other sensitive information with a known weak encryption method (MD5 hash of CVE-2019-39087.5Premisys Identicard version 3.1.190 stores backup files as encrypted zip files. The password to the zip is hard-coded and unchangeable. An a CVE-2019-39099.8Premisys Identicard version 3.1.190 database uses default credentials. Users are unable to change the credentials without vendor interventio CVE-2019-39109.1Crestron AM-100 before firmware version 1.6.0.2 contains an authentication bypass in the web interface's return.cgi script. Unauthenticated CVE-2019-39116.1Reflected cross-site scripting (XSS) vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 allows an unauthenticated remo CVE-2019-39126.1An open redirect vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 via the /__r1/ returnURL parameter allows an unaut CVE-2019-39134.9Command manipulation in LabKey Server Community Edition before 18.3.0-61806.763 allows an authenticated remote attacker to unmount any drive CVE-2019-39147.2Remote command injection vulnerability in Verizon Fios Quantum Gateway (G1100) firmware version 02.01.00.05 allows a remote, authenticated a CVE-2019-39157.5Authentication Bypass by Capture-replay vulnerability in Verizon Fios Quantum Gateway (G1100) firmware version 02.01.00.05 allows an unauthe CVE-2019-39167.5Information disclosure vulnerability in Verizon Fios Quantum Gateway (G1100) firmware version 02.01.00.05 allows an remote, unauthenticated CVE-2019-39177.5The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 allows a remote, unauthenticated attacker to enable telnetd on th CVE-2019-39189.8The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 contains multiple hard coded credentials for the Telnet and SSH i