What is CVE-2015-2909?

CVE-2015-2909 is a critical-severity vulnerability in Dedicated Micros Ds2, classified under Improper Privilege Management. CVSS score: 9.8/10. Published 2020-02-06.

How severe is CVE-2015-2909?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Privilege escalation in Dedicated Micros Ds2

CVE-2015-2909

Dedicated Micros DV-IP Express, SD Advanced, SD, EcoSense, and DS2 devices rely on a GUI warning to help ensure that the administrator configures login credentials, which makes it easier for remote attackers to obtain access by leveraging situations in which this warning was not heeded. NOTE: the vendor states "The user is presented with clear warnings on the GUI that they should set usernames and passwords."

Vulnerability class: Privilege Escalation

Published 2020-02-06 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.029 (86.6th percentile), scored 2026-09-29.

Low probability of exploitation in the next 30 days, but still tracked. 87th percentile — 86.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.029 · newest: 0.029 · change: 0.000

Affected products

Weakness classification (CWE)

CWE-269 — Improper Privilege Management

References

cybergibbons.com/security-2/shodan-searches/interesting-shodan-searches-sd-adva… (Exploit, Third Party Advisory)
www.kb.cert.org/vuls/id/276148 (US Government Resource, Third Party Advisory)

Frequently asked questions

What is CVE-2015-2909?: CVE-2015-2909 is a critical-severity vulnerability in Dedicated Micros Ds2, classified under Improper Privilege Management. CVSS score: 9.8/10. Published 2020-02-06.
How severe is CVE-2015-2909?: Critical severity. CVSS v3 base score is 9.8 out of 10.