CVE-2019-5101 is an information leak vulnerability affecting the ustream-ssl library in OpenWrt versions 18.06.4 and 15.05.1. The flaw allows an attacker to perform a man-in-the-middle attack by presenting an invalid SSL certificate, which the affected software fails to properly act upon. This enables the theft of data sent by the client during the initial connection. The vulnerability has a CVSS v3.1 score of 5.9 (Medium), indicating a network-based attack with high impact on confidentiality and high attack complexity, requiring no user interaction. There is no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
15.05.1CPE matchmatch criteria | cpe:2.3:o:openwrt:openwrt:15.05.1:*:*:*:*:*:*:* | ||
18.06.4CPE matchmatch criteria | cpe:2.3:o:openwrt:openwrt:18.06.4:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.