9.8

CVE-2016-2358

Exploit
Milesight IP security cameras through 2016-11-14 have a default set of 10 privileged accounts with hardcoded credentials. They are accessible if the customer has not configured 10 actual user accounts.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Milesight ≫ Ip Security Camera Firmware Version <= 2016-11-14
   Milesight ≫ Ip Security Camera Version-
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.06% 0.789
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
CWE-798 Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.

http://kirils.org/slides/2016-10-06_Milesight_initial.pdf
Third Party Advisory
Exploit
https://possiblesecurity.com/news/vulnerabilities-of-milesight-ip-security-cameras/
Third Party Advisory
https://www.youtube.com/watch?v=scckkI7CAW0
Third Party Advisory
Exploit