Path Traversal in Hanwha-Security Smart Security Manager
CVE-2017-5168
An issue was discovered in Hanwha Techwin Smart Security Manager Versions 1.5 and prior. Multiple Path Traversal vulnerabilities have been identified. The flaws exist within the ActiveMQ Broker service that is installed as part of the product. By issuing specific HTTP requests, if a user visits a malicious page, an attacker can gain access to arbitrary files on the server. Smart Security Manager Versions 1.4 and prior to 1.31 are affected by these vulnerabilities. These vulnerabilities can allow for remote code execution.
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.036 (88.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Hanwha-security Smart_security_manager
- N/a Hanwha Techwin Smart Security Manager Versions 1.5 And Prior — versions Hanwha Techwin Smart Security Manager Versions 1.5 and prior
Weakness classification (CWE)
References
- ics-cert@hq.dhs.gov (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- ics-cert@hq.dhs.gov (US Government Resource, Patch, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2017-5168?
- CVE-2017-5168 is a high-severity vulnerability in Hanwha-Security Smart Security Manager, classified under Path Traversal. CVSS score: 7.5/10. Published 2017-02-13.
- How severe is CVE-2017-5168?
- High severity. CVSS v3 base score is 7.5 out of 10.