CVE-2019-19967

Vulnerability

The Connect Box EuroDOCSIS 3.0 Voice Gateway CH7465LG-NCIP-6.12.18.25-2p6-NOSH exposes an administrative interface that transmits credentials in cleartext. When an administrator logs in via a POST request to the /xml/setter.xml URI over port 80, the Password field is sent as plaintext without encryption [1]. This affects all devices running firmware version 6.12.18.25-2p6-NOSH as discovered and reported by researchers [1].

Exploitation

An attacker with network access to the router's management interface (typically on the local LAN, or any position capable of sniffing traffic) can capture the cleartext administrator password by performing packet sniffing (e.g., with Wireshark) while an administrator submits the login form. The attacker does not need any prior authentication or special privileges beyond the ability to observe HTTP traffic. The vulnerability is triggered when the administrator accesses the administration page and submits the POST request [1].

Impact

Successful exploitation results in full disclosure of the administrator's cleartext password. The attacker can then gain administrative control over the device, potentially altering Wi‑Fi settings, DNS configurations, firewall rules, or other router parameters. This compromises the confidentiality and integrity of the network managed by the router. The confidentiality of the password itself is also directly violated [1].

Mitigation

The vendor (Connect Box / the device manufacturer) was contacted by the researcher, and the vulnerability was registered as CVE-2019-19967 [1]. As of the publication date, no firmware update has been publicly released to enforce encrypted communications (e.g., HTTPS) for the administration interface. Users should consider disabling remote administration and limiting access to the management interface only to trusted, physically secured networks. If the device is no longer supported, replacement with a security-updated model is recommended [1].