What is CVE-2018-16225?

CVE-2018-16225 is a medium-severity vulnerability in Qbeecam, classified under Cleartext Transmission of Sensitive Information. CVSS score: 6.5/10. Published 2018-09-18.

How severe is CVE-2018-16225?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Is CVE-2018-16225 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Qbeecam

CVE-2018-16225

The QBee MultiSensor Camera through 4.16.4 accepts unencrypted network traffic from clients (such as the QBee Cam application through 1.0.5 for Android and the Swisscom Home application up to 10.7.2 for Android), which results in an attacker being able to reuse cookies to bypass authentication and disable the camera.

EPSS: 0.006 (45.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Qbeecam
Qbeecam Qbee_multi-sensor_camera
Qbeecam Qbee_multi-sensor_camera_firmware
Swisscom Swisscom_home_app
N/a — versions n/a

Weakness classification (CWE)

CWE-319 — Cleartext Transmission of Sensitive Information

Public proof-of-concept exploits

infosecjosh/dfrws2019

References

cve@mitre.org (mailing-list, x_refsource_FULLDISC, Mailing List, Third Party Advisory)
cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2018-16225?: CVE-2018-16225 is a medium-severity vulnerability in Qbeecam, classified under Cleartext Transmission of Sensitive Information. CVSS score: 6.5/10. Published 2018-09-18.
How severe is CVE-2018-16225?: Medium severity. CVSS v3 base score is 6.5 out of 10.
Is CVE-2018-16225 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.