IDenticard vulnerabilities (CVEs)

5 CVEs matched to IDenticard by name in NVD, none on CISA's Known Exploited list.

Back to the IDenticard profile · Alternatives to IDenticard · CVE RSS feed

Exploitation riskProbably exploited

5 of 5 CVEs assessed

confirmed exploited

EPSS ≥ 10%

94%

highest single CVE

2 CVEs have an estimated 10%-or-higher chance of having already been exploited despite not appearing on CISA's KEV catalog. KEV is a curated record of confirmed cases rather than a complete census, so this is where its coverage is likely thinnest — an estimate from EPSS history, not a finding. Based on a median of 2 EPSS observations per CVE.

Likely-exploited estimates here rest on a median of 2 EPSS observations per CVE — too little history to read as a trend yet. It deepens daily as scores are collected.

CVE-2019-3906 ↗EPSS 2.9%LEV ≥94%Probably exploited
Premisys Identicard version 3.1.190 contains hardcoded credentials in the WCF service on port 9003. An authenticated remote attacker can use these credentials t…
CVE-2019-3909 ↗EPSS 2.3%LEV ≥88%Probably exploited
Premisys Identicard version 3.1.190 database uses default credentials. Users are unable to change the credentials without vendor intervention.
CVE-2019-3908 ↗EPSS 1.8%LEV ≥82%Probably exploited
Premisys Identicard version 3.1.190 stores backup files as encrypted zip files. The password to the zip is hard-coded and unchangeable. An attacker with access …

Recent changes

last 90 days

CVE-2019-3906 is now estimated at a 93% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-01 · NVD ↗
CVE-2019-3909 is now estimated at a 88% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-01 · NVD ↗
CVE-2017-14973 is now estimated at a 42% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-08-31 · NVD ↗
CVE-2019-3908 is now estimated at a 81% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-08-31 · NVD ↗
CVE-2019-3909 is now estimated at a 88% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-08-31 · NVD ↗

CVE severity over time

CVEs by year and severity

Count of matched CVEs by the year NVD published them.
Year	Critical	High	Medium	Low	Unscored	Total
2019	1	3	0	0	0	4
2017	0	0	1	0	0	1

Highest EPSS scores

EPSS is FIRST's estimate of the chance a CVE is exploited in the next 30 days. It measures likelihood, not impact.

CVE	EPSS	Percentile
CVE-2019-3906	2.9%	87%
CVE-2019-3909	2.3%	83%
CVE-2019-3908	1.8%	78%
CVE-2019-3907	0.7%	52%
CVE-2017-14973	0.5%	41%

Known CVEs (5)

RSS ⇢

CVE-2019-3909 ↗CRITICAL 9.82019
Premisys Identicard version 3.1.190 database uses default credentials. Users are unable to change the credentials without vendor intervention.
CVE-2019-3908 ↗HIGH 7.52019
Premisys Identicard version 3.1.190 stores backup files as encrypted zip files. The password to the zip is hard-coded and unchangeable. An attacker with access to these backups can decrypt them and ob…
CVE-2019-3907 ↗

How this is counted

CVEs come from the US National Vulnerability Database (NVD) and are matched to IDenticard by vendor name. A name match can include CVEs that concern a similarly named product, and can miss ones filed under another name. The count reflects how widely a vendor's software is deployed and examined as much as anything else, so it is not a measure of how secure the vendor is and should not be used to rank vendors. Latest CVE added here: 2026-08-31.
Known-exploited status comes from the CISA Known Exploited Vulnerabilities (KEV) catalog. Last checked: 2026-10-21.
Exploit probability (EPSS) comes from FIRST. Latest score date: 2026-10-20.