What’s Vulnerable › Vulnerabilities
CVE-2019-5102
- Severity: medium (CVSS 5.9 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.8% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2019-11-18 · updated 2026-06-17
- Weakness: CWE-295
Description
An exploitable information leak vulnerability exists in the ustream-ssl library of OpenWrt, versions 18.06.4 and 15.05.1. When connecting to a remote server, the server's SSL certificate is checked but no action is taken when the certificate is invalid. An attacker could exploit this behavior by performing a man-in-the-middle attack, providing any certificate, leading to the theft of all the data sent by the client during the first request.An exploitable information leak vulnerability exists in the ustream-ssl library of OpenWrt, versions 18.06.4 and 15.05.1. When connecting to a remote server, the server's SSL certificate is checked but no action is taken when the certificate is invalid. An attacker could exploit this behavior by performing a man-in-the-middle attack, providing any certificate, leading to the theft of all the data sent by the client during the first request.
Affected products
- openwrt: 15.05.1, 18.06.4
References
- https://talosintelligence.com/vulnerability_reports/TALOS-2019-0893
- https://talosintelligence.com/vulnerability_reports/TALOS-2019-0893
Get alerted when CVE-2019-5102 or the next vulnerability affects your stack