Vulnerabilities > CVE-2019-9555 - Insufficient Entropy vulnerability in Sagemcom F@St 5260 Firmware 0.4.39

047910
CVSS 5.0 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
NONE
Availability impact
NONE
network
low complexity
sagemcom
CWE-331
NVD
Published: 2019-03-05
Updated: 2020-08-24

Summary

Sagemcom F@st 5260 routers using firmware version 0.4.39, in WPA mode, default to using a PSK that is generated from a 2-part wordlist of known values and a nonce with insufficient entropy. The number of possible PSKs is about 1.78 billion, which is too small.

Vulnerable Configurations

Part Description Count
OS
Sagemcom
1
Hardware
Sagemcom
1

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Session Credential Falsification through Prediction
    This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/151976/sagemcom-psk.txt
idPACKETSTORM:151976
last seen2019-03-07
published2019-03-05
reporterRyan Delaney
sourcehttps://packetstormsecurity.com/files/151976/Sagemcom-Router-Insufficient-Default-PSK-Entropy.html
titleSagemcom Router Insufficient Default PSK Entropy

References