CVE-2014-8389

Опубликовано: 28 дек. 2017

Источник: nvd

CVSS3: 9.8

CVSS2: 10

EPSS Средний

Описание

cgi-bin/mft/wireless_mft.cgi in AirLive BU-2015 with firmware 1.03.18 16.06.2014, AirLive BU-3026 with firmware 1.43 21.08.2014, AirLive MD-3025 with firmware 1.81 21.08.2014, AirLive WL-2000CAM with firmware LM.1.6.18 14.10.2011, and AirLive POE-200CAM v2 with firmware LM.1.6.17.01 uses hard-coded credentials in the embedded Boa web server, which allows remote attackers to obtain user credentials via crafted HTTP requests.

Ссылки

http://packetstormsecurity.com/files/132585/AirLive-Remote-Command-Injection.html
Exploit
Mitigation
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2015/Jul/29
Exploit
Mailing List
Mitigation
Third Party Advisory
http://www.securityfocus.com/archive/1/535938/100/0/threaded
http://www.securityfocus.com/bid/75559
Exploit
Mitigation
Third Party Advisory
VDB Entry
https://www.coresecurity.com/advisories/airlive-multiple-products-os-command-injection
Exploit
Mitigation
Technical Description
Third Party Advisory
http://packetstormsecurity.com/files/132585/AirLive-Remote-Command-Injection.html
Exploit
Mitigation
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2015/Jul/29
Exploit
Mailing List
Mitigation
Third Party Advisory
http://www.securityfocus.com/archive/1/535938/100/0/threaded
http://www.securityfocus.com/bid/75559
Exploit
Mitigation
Third Party Advisory
VDB Entry
https://www.coresecurity.com/advisories/airlive-multiple-products-os-command-injection
Exploit
Mitigation
Technical Description
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:airlive:bu-3026_firmware:1.43_21.08.2014:*:*:*:*:*:*:*

cpe:2.3:h:airlive:bu-3026:-:*:*:*:*:*:*:*

Конфигурация 2

Одновременно

cpe:2.3:o:airlive:md-3025_firmware:1.81_21.08.2014:*:*:*:*:*:*:*

cpe:2.3:h:airlive:md-3025:-:*:*:*:*:*:*:*

Конфигурация 3

Одновременно

cpe:2.3:o:airlive:wl-2000cam_firmware:lm.1.6.18_14.10.2011:*:*:*:*:*:*:*

cpe:2.3:h:airlive:wl-2000cam:-:*:*:*:*:*:*:*

Конфигурация 4

Одновременно

cpe:2.3:o:airlive:poe-200cam_v2_firmware:lm.1.6.17.01:*:*:*:*:*:*:*

cpe:2.3:h:airlive:poe-200cam_v2:-:*:*:*:*:*:*:*

Конфигурация 5

Одновременно

cpe:2.3:o:airlive:bu-2015_firmware:1.03.18_16.06.2014:*:*:*:*:*:*:*

cpe:2.3:h:airlive:bu-2015:-:*:*:*:*:*:*:*

EPSS

Процентиль: 94%

0.14008

Средний

9.8 Critical

CVSS3

10 Critical

CVSS2

Дефекты

CWE-78

Связанные уязвимости

GHSA-4xc5-wc24-8f5h

CVSS3: 9.8

github

больше 3 лет назад

BDU:2018-00220

CVSS3: 9.8

fstec

больше 10 лет назад

Уязвимость сценария cgi-bin/mft/wireless_mft.cgi микропрограммного обеспечения IP-камер AirLive, позволяющая нарушителю получить учетные данные пользователей

EPSS

Процентиль: 94%

0.14008

Средний

9.8 Critical

CVSS3

10 Critical

CVSS2

Дефекты

CWE-78