Comba AP2600-I devices through A02,0202N00PD2 are prone to password disclosure via an insecure authentication mechanism.

published 2020-03-19 6 y ago modified 2026-06-17 4 mo ago also EUVD-2019-6605

cvss: 7.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.8%; EPSS 0.8% chance of exploitation in 30 days, percentile 57%
public exploits: 0; none known

Comba AP2600-I devices through A02,0202N00PD2 are prone to password disclosure via an insecure authentication mechanism. The HTML source code of the login page contains values that allow obtaining the username and password. The username are password values are a double md5 of the plaintext real value, i.e., md5(md5(value)).

Exploit prediction

0.83% chance of exploitation in the next 30 days, higher than 57% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

trustwave.com https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=26164 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:P/I:N/A:N

Classification

Weakness

CWE-311 Missing Encryption of Sensitive Data
CWE-327 Use of a Broken or Risky Cryptographic Algorithm
CWE-522 Insufficiently Protected Credentials

References

trustwave.com /en-us/resources/security-resources/security-advisories/?fid=26164
exploit, third-party-advisory
comba-telecom.com /en/news
vendor-advisory

Sources

CVE List CVE-2019-15653
NVD CVE-2019-15653

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary