Information disclosure in Sv3c H.264 Poe Ip Camera Firmware
CVE-2018-12671
An attacker with remote access to the SV3C HD Camera (L-SERIES V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B) web interface can disclose information about the camera including all password sets set within the camera. This information can then be used to gain access to the web interface.
Vulnerability class: Information Disclosure
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.013 (68.7th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 69th percentile — 68.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.013 · newest: 0.013 · change: 0.000
Affected products
- Sv3c H.264 Poe Ip Camera Firmware — versions v2.3.4.2103-s50-ntd-b20170508b, v2.3.4.2103-s50-ntd-b20170823b
- Sv3c Sv-B01poe-1080p-L
- Sv3c Sv-B11vpoe-1080p-L
- Sv3c Sv-D02poe-1080p-L
Weakness classification (CWE)
References
- www.bishopfox.com/news/2018/10/sv3c-l-series-hd-camera-multiple-vulnerabilities/ (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2018-12671?
- CVE-2018-12671 is a critical-severity vulnerability in Sv3c H.264 Poe Ip Camera Firmware, classified under Information Disclosure. CVSS score: 9.8/10. Published 2018-10-19.
- How severe is CVE-2018-12671?
- Critical severity. CVSS v3 base score is 9.8 out of 10.