TI-2019-02912 Aliases CVE-2019-3906 GHSA-5wqr-f6rg-xf95

Hard-coded credentials in Premisys Identicard 3.1.190

MEDIUM 43CWE-798Published 2019-01-18 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-798.

Summary

Premisys Identicard version 3.1.190 contains hardcoded credentials in the WCF service on port 9003. An authenticated remote attacker can use these credentials to access the badge system database and modify its contents.

Why it matters now

EPSS 0.0289 86th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	Premisys Identicard 3.1.190	Premisys Identicard 3.1.190	—	No fix listed	CNA

Premisys Identicard 3.1.190 Vendor— Affected Premisys Identicard 3.1.190 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:identicard:premisys_id:3.1.190:::::::*	3.1.190	Vulnerable	Identicard

cpe:2.3:a:identicard:premisys_id:3.1.190:*:*:*:*:*:*:* Versions 3.1.190 Vulnerable ·Identicard

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2019-3906
2026-10-03 Alias added: GHSA-5wqr-f6rg-xf95

References

Advisory 1

https://www.tenable.com/security/research/tra-2019-01

TI-2019-02915 Premisys Identicard version 3.1.190 database uses default credentials. CVSS 3.0CRITICAL 9.8
TI-2019-02914 Hard-coded credentials in Premisys Identicard 3.1.190 CVSS 3.1HIGH 7.5
TI-2019-02913 Hard-coded credentials in Premisys Identicard 3.1.190 CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences