CVE-2019-19898

Vulnerability

In IXP EasyInstall version 6.2.13723, the Administrator console transmits authentication credentials in cleartext over TCP port 20050 [1]. The vulnerability exists in the network communication channel used when managing the software remotely, allowing any party with network access to observe credentials without encryption [1].

Exploitation

An attacker with network access to the TCP 20050 port can passively capture cleartext credentials during legitimate Administrator console sessions [1]. No authentication is required to intercept the traffic, and the attacker only needs to be positioned on a network segment where the traffic is visible (e.g., same local network, or via ARP spoofing) [1].

Impact

Successful exploitation results in disclosure of cleartext credentials used for administrative access to the IXP EasyInstall system [1]. An attacker can then use these credentials to gain unauthorized administrative access, potentially compromising the entire installation and related managed endpoints [1].

Mitigation

The vendor has not released a public fix for this vulnerability as of the publication date [1]. As a workaround, network administrators can restrict access to TCP port 20050 to trusted hosts only, or use VPNs and network segmentation to prevent eavesdropping [1].