Verizon CVE-2019-3916

HIGH

Direct Request ('Forced Browsing') (CWE-425)

2019-04-11 vulnreport@tenable.com

Information Disclosure Verizon Fios Quantum Gateway G1100 Firmware

7.5

CVSS 3.0 · NVD

Share

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

1

CVE Published

Apr 11, 2019 - 15:29 nvd

HIGH 7.5

DescriptionNVD

Information disclosure vulnerability in Verizon Fios Quantum Gateway (G1100) firmware version 02.01.00.05 allows an remote, unauthenticated attacker to retrieve the value of the password salt by simply requesting an API URL in a web browser (e.g. /api).

AnalysisAI

Information disclosure vulnerability in Verizon Fios Quantum Gateway (G1100) firmware version 02.01.00.05 allows an remote, unauthenticated attacker to retrieve the value of the password salt by. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-425. Information disclosure vulnerability in Verizon Fios Quantum Gateway (G1100) firmware version 02.01.00.05 allows an remote, unauthenticated attacker to retrieve the value of the password salt by simply requesting an API URL in a web browser (e.g. /api). Affected products include: Verizon Fios Quantum Gateway G1100 Firmware. Version information: version 02.01.00.05.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Verizon

View all

CVE-2022-28375 CRITICAL Act Now POC

Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 does not property sanitize user-controlled parameters within the cr

CVE-2022-28373 CRITICAL Act Now POC

Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 does not properly sanitize user-controlled parameters within the crt

CVE-2022-28369 CRITICAL Act Now POC

Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 does not validate the user-provided URL within the crtcmode function

CVE-2022-28374 HIGH This Week POC

Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 does not property sanitize user-controlled parameters within the DM

CVE-2022-28376 HIGH This Week POC

Verizon 5G Home LVSKIHP outside devices through 2022-02-15 allow anyone (knowing the device's serial number) to access a

CVE-2022-28377 HIGH This Week POC

On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC en

CVE-2022-28372 HIGH This Week POC

On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC en

CVE-2022-28371 HIGH This Week POC

On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC en

CVE-2022-28370 HIGH This Week POC

On Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 devices, the RPC endpoint crtc_fw_upgrade provides a means of pr

CVE-2022-29729 HIGH This Week POC

Verizon 4G LTE Network Extender GA4.38 - V0.4.038.2131 utilizes a weak default admin password generation algorithm which

CVE-2019-3914 HIGH This Week POC

Remote command injection vulnerability in Verizon Fios Quantum Gateway (G1100) firmware version 02.01.00.05 allows a rem

CVE-2013-0126 MEDIUM This Month POC

Multiple cross-site request forgery (CSRF) vulnerabilities in index.cgi on the Verizon FIOS Actiontec MI424WR-GEN3I rout

Same weakness CWE-425 – Direct Request ('Forced Browsing')

View all

CVE-2017-14244 CRITICAL POC

CVE-2024-0204 CRITICAL POC

CVE-2017-15235 HIGH POC

CVE-2024-24592 CRITICAL POC

CVE-2022-45276 CRITICAL POC

CVE-2022-26279 CRITICAL POC

CVE-2021-36560 CRITICAL POC

CVE-2020-24660 CRITICAL POC

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

CVE-2021-34523 CRITICAL POC

CVE-2013-2251 CRITICAL POC

CVE-2017-5638 CRITICAL POC

CVE-2025-24813 CRITICAL POC

CVE-2015-1701 HIGH POC

CVE-2017-0147 HIGH POC

CVE-2014-6324 HIGH POC

Share

CVE-2019-3916 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy