Auth bypass in Cisco Video Surveillance Manager

CVE-2013-3431

Cisco Video Surveillance Manager (VSM) before 7.0.0 does not require authentication for access to VSMC monitoring pages, which allows remote attackers to obtain sensitive configuration, archive, and log information via unspecified vectors, related to the Cisco_VSBWT (aka Broadware sample code) package, aka Bug ID CSCsv40169.

Vulnerability class: Broken Authentication

EPSS: 0.093 (94.8th percentile) — read the EPSS interpretation.

Affected products

Cisco Video_surveillance_manager — versions 1.1.0, 1.2.1, 2.0.0
N/a — versions n/a

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

psirt@cisco.com (vdb-entry, x_refsource_XF)
psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)
psirt@cisco.com (vdb-entry, x_refsource_BID)
psirt@cisco.com (vdb-entry, x_refsource_SECTRACK)