CVE-2019-15653

Vulnerability

Comba AP2600-I devices through firmware version A02,0202N00PD2 contain an insecure authentication mechanism. The login page HTML source code exposes username and password fields with values that are double MD5 hashes (md5(md5(plaintext))) of the actual credentials, allowing an attacker to obtain the hashed password directly.

Exploitation

An attacker with network access to the device's login page can view the page source to retrieve the double MD5 hash values. Since MD5 is cryptographically weak, the attacker can reverse the hashes using precomputed rainbow tables or brute force to recover the plaintext username and password. No authentication or user interaction is required.

Impact

Successful exploitation results in full disclosure of administrative credentials, granting the attacker complete control over the device. This can lead to unauthorized access to the network, interception or modification of traffic, and further compromise of connected systems.

Mitigation

As of the publication date and available references, no firmware patch or workaround has been disclosed. Users are advised to restrict network access to the device login page and monitor for vendor updates.