CVE Vulnerabilities

CVE-2019-18872

Weak Password Requirements

Published: May 07, 2020 | Modified: May 12, 2020
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:N/I:P/A:N
RedHat/V2
RedHat/V3
Ubuntu

Weak password requirements in Blaauw Remote Kiln Control through v3.00r4 allow a user to set short or guessable passwords (e.g., 1 or 1234).

Weakness

The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.

Affected Software

Name Vendor Start Version End Version
Remote_kiln_control Blaauwproducts 3.0.0-v4 (including) 3.0.0-v4 (including)

Potential Mitigations

  • A product’s design should require adherance to an appropriate password policy. Specific password requirements depend strongly on contextual factors, but it is recommended to contain the following attributes:

  • Depending on the threat model, the password policy may include several additional attributes.

  • See NIST 800-63B [REF-1053] for further information on password requirements.

References