Privilege escalation in Dedicated Micros Ds2
CVE-2015-2909
Dedicated Micros DV-IP Express, SD Advanced, SD, EcoSense, and DS2 devices rely on a GUI warning to help ensure that the administrator configures login credentials, which makes it easier for remote attackers to obtain access by leveraging situations in which this warning was not heeded. NOTE: the vendor states "The user is presented with clear warnings on the GUI that they should set usernames and passwords."
Vulnerability class: Privilege Escalation
EPSS: 0.029 (85.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Dedicated Micros Ds2 — versions unknown
- Dedicated Micros Dv-ip Express — versions unknown
- Dedicated Micros Ecosense — versions unknown
- Dedicated Micros Sd — versions unknown
- Dedicated Micros Sd Advanced — versions unknown
- Netvu Ds2_\(dvtr\)
- Netvu Ds2_\(dvtr\)_firmware
- Netvu Ds2_\(dvtu\)
- Netvu Ds2_\(dvtu\)_firmware
- Netvu Ds2_\(dvtx\)
Weakness classification (CWE)
References
- cret@cert.org (Exploit, Third Party Advisory, x_refsource_MISC)
- cret@cert.org (US Government Resource, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2015-2909?
- CVE-2015-2909 is a critical-severity vulnerability in Dedicated Micros Ds2, classified under Improper Privilege Management. CVSS score: 9.8/10. Published 2020-02-06.
- How severe is CVE-2015-2909?
- Critical severity. CVSS v3 base score is 9.8 out of 10.