CVE-2019-25552
Cewe Photo Show 6.4.3
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2019-25552 is a high-severity Use of Password Hash Instead of Password for Authentication (CWE-836) vulnerability in Cewe Photo Show. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Pass the Hash (T1550.002); ranked at the 32th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to IA-2 (Identification and Authentication (Organizational Users)) and IA-5 (Authenticator Management) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2019-25552 is a denial of service vulnerability affecting CEWE PHOTO SHOW version 6.4.3. The issue arises from the application's failure to properly handle an excessively long buffer submitted to the password field during the upload process, allowing attackers to crash the program by pasting a large string of repeated characters into the input.
The vulnerability can be exploited by any network-accessible attacker with no privileges required and low complexity, as reflected in its CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and associated CWE-836. Exploitation leads to a complete application crash, resulting in denial of service for the affected instance.
Advisories and references, including those from VulnCheck detailing the denial of service via the password field, an Exploit-DB entry (46861), and the vendor site at cewe-photoworld.com, provide further details but no specific patch or mitigation guidance is outlined in the available information.
A proof-of-concept exploit is publicly available on Exploit-DB, confirming practical exploitability published on 2026-03-21.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19852
Vulnerability Data
CEWE PHOTO SHOW 6.4.3 contains a denial of service vulnerability that allows attackers to crash the application by submitting an excessively long buffer to the password field. Attackers can paste a large string of repeated characters into the password input…
more
during the upload process to trigger an application crash.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires proper identification and authentication of users, which structurally precludes accepting password hashes in place of passwords.
Authenticator management requires secure distribution, verification, and handling of passwords rather than allowing direct submission and comparison of hashes.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Proper authentication mechanisms require passwords (not pre-hashed values) to be supplied by the claimant and verified server-side.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Directly requires secure handling and protection of authentication credentials, preventing storage or comparison of password hashes as if they were passwords.
Mandates secure authentication mechanisms that preclude the flawed practice of treating password hashes as authenticators.
Requires proper cryptographic practices for protecting passwords, indirectly mitigating misuse of hashes in authentication.
Secure coding guidance can prevent this implementation error but does not address the control's broader intent.