CVE-2001-1550: CentraOne 5.2 and Centra ASP with basic authentication enabled creates world-writable base64 encoded log files

Routine

LOW 2.1MITIGATEDOWNGRADEDOWNGRADE

CVE-2001-1550 is a low-severity flaw (CVSS 2.1) affecting asp, centraone, smart connect. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

CentraOne 5.2 and Centra ASP with basic authentication enabled creates world-writable base64 encoded log files, which allows local users to obtain cleartext passwords from decoded log files and impersonate users.

Why this priority

No elevated risk signals yet

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	2.1 (Low)
EPSS exploit chance	0.4% (top 69%)
CISA exploited list	No
Published	2001-12-31
Last modified	2026-06-16

Publisher (CNA): MITRE · Vendor: centra

Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2001-12-31 05:00 UTCPublished CVE record published
2026-06-16 21:56 UTCUpdated Record last modified

centra asp MITIGATE

Affected: all versions

Fixed in: no fixed release known

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy asp || rpm -q asp || asp --version

No fixed or unaffected release known

Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access.

centra centraone DOWNGRADE

Affected: 5.2

Fixed in: no fixed release known

Safe to downgrade to: a release before 5.2

1. Check installed version

apt-cache policy centraone || rpm -q centraone || centraone --version

2. No fixed release: DOWNGRADE to a release before 5.2 (Debian / Ubuntu)

apt-cache madison centraone sudo apt install centraone=<VERSION_BEFORE_5.2> sudo apt-mark hold centraone

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list centraone sudo dnf downgrade centraone-<VERSION_BEFORE_5.2> sudo dnf versionlock add centraone

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

centra smart connect DOWNGRADE

Affected: cen5.2-03

Fixed in: no fixed release known

Safe to downgrade to: a release before cen5.2-03

1. Check installed version

apt-cache policy smart-connect || rpm -q smart-connect || smart-connect --version

2. No fixed release: DOWNGRADE to a release before cen5.2-03 (Debian / Ubuntu)

apt-cache madison smart-connect sudo apt install smart-connect=<VERSION_BEFORE_cen5.2-03> sudo apt-mark hold smart-connect

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list smart-connect sudo dnf downgrade smart-connect-<VERSION_BEFORE_cen5.2-03> sudo dnf versionlock add smart-connect

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2001-1550?

asp: mitigate or apply the listed mitigation; centraone: downgrade or apply the listed mitigation; smart connect: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2001-1550 being exploited?

CVE-2001-1550 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2001-1550 affect?

CVE-2001-1550 affects asp, centraone, smart connect. Severity is low (CVSS 2.1). CentraOne 5.2 and Centra ASP with basic authentication enabled creates world-writable base64 encoded log files, which allows local users to obtain cleartext passwords from decoded log files and impersonate users.

How urgent is CVE-2001-1550?

Priority 15/100. No elevated risk signals yet.

References

← Back to latest CVEs