What is CVE-2018-12666?

CVE-2018-12666 is a critical-severity vulnerability in Sv3c H.264 Poe Ip Camera Firmware, classified under Improper Authentication. CVSS score: 9.8/10. Published 2018-10-19.

How severe is CVE-2018-12666?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Auth bypass in Sv3c H.264 Poe Ip Camera Firmware

CVE-2018-12666

SV3C L-SERIES HD CAMERA V2.3.4.2103-S50-NTD-B20170508B devices improperly identifies users only by the authentication level sent in the cookies, which allow remote attackers to bypass authentication and gain administrator access by setting the authLevel cookie to 255.

Vulnerability class: Broken Authentication

EPSS: 0.018 (76.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Sv3c H.264_poe_ip_camera_firmware — versions v2.3.4.2103-s50-ntd-b20170508b, v2.3.4.2103-s50-ntd-b20170823b
Sv3c Sv-b01poe-1080p-l
Sv3c Sv-b11vpoe-1080p-l
Sv3c Sv-d02poe-1080p-l
N/a — versions n/a

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2018-12666?: CVE-2018-12666 is a critical-severity vulnerability in Sv3c H.264 Poe Ip Camera Firmware, classified under Improper Authentication. CVSS score: 9.8/10. Published 2018-10-19.
How severe is CVE-2018-12666?: Critical severity. CVSS v3 base score is 9.8 out of 10.