CVE-2019-25552
Cewe Photo Show 6.4.3
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2019-25552 is a high-severity Use of Password Hash Instead of Password for Authentication (CWE-836) vulnerability in Cewe Photo Show. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 32th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2019-25552 is a denial of service vulnerability affecting CEWE PHOTO SHOW version 6.4.3. The issue arises from the application's failure to properly handle an excessively long buffer submitted to the password field during the upload process, allowing attackers to crash the program by pasting a large string of repeated characters into the input.
The vulnerability can be exploited by any network-accessible attacker with no privileges required and low complexity, as reflected in its CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and associated CWE-836. Exploitation leads to a complete application crash, resulting in denial of service for the affected instance.
Advisories and references, including those from VulnCheck detailing the denial of service via the password field, an Exploit-DB entry (46861), and the vendor site at cewe-photoworld.com, provide further details but no specific patch or mitigation guidance is outlined in the available information.
A proof-of-concept exploit is publicly available on Exploit-DB, confirming practical exploitability published on 2026-03-21.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19852
Vulnerability Data
CEWE PHOTO SHOW 6.4.3 contains a denial of service vulnerability that allows attackers to crash the application by submitting an excessively long buffer to the password field. Attackers can paste a large string of repeated characters into the password input…
more
during the upload process to trigger an application crash.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in password field directly enables application crash via exploitation (T1499.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates input validation at the password field to reject excessively long buffers, preventing the DoS crash from mishandled input.
Enforces input restrictions like maximum length at the password field during upload, blocking oversized strings that trigger the crash.
Implements protections to limit effects of denial-of-service events such as the application crash from excessive password buffer input.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Proper authentication mechanisms require passwords (not pre-hashed values) to be supplied by the claimant and verified server-side.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Directly requires secure handling and protection of authentication credentials, preventing storage or comparison of password hashes as if they were passwords.
Mandates secure authentication mechanisms that preclude the flawed practice of treating password hashes as authenticators.
Requires proper cryptographic practices for protecting passwords, indirectly mitigating misuse of hashes in authentication.
Secure coding guidance can prevent this implementation error but does not address the control's broader intent.