Weak Password Storage Vulnerability in Versa Director and Analytics by Versa Networks

CVE-2019-25030

What is CVE-2019-25030?

In Versa Director, Analytics, and VOS, stored passwords lack adequate security due to the use of outdated hashing methods. These systems do not employ adaptive cryptographic hash functions or key derivation functions prior to password storage. This creates a significant risk as attackers can utilize precomputed hash values, known as rainbow tables, to quickly crack weakly hashed passwords. Implementing adaptive hashing algorithms like scrypt or bcrypt, or using Key-Derivation Functions such as PBKDF2 can drastically improve password security by rendering the generation of rainbow tables computationally infeasible.

References