CVE-2016-9155

Published: 22/11/2016 Updated: 23/12/2016

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

The following SIEMENS branded IP Camera Models CCMW3025, CVMW3025-IR, CFMW3025 prior to version 1.41_SP18_S1; CCPW3025, CCPW5025 prior to version 0.1.73_S1; CCMD3025-DN18 prior to version v1.394_S1; CCID1445-DN18, CCID1445-DN28, CCID1145-DN36, CFIS1425, CCIS1425, CFMS2025, CCMS2025, CVMS2025-IR, CFMW1025, CCMW1025 prior to version v2635_SP1 could allow an attacker with network access to the web server to obtain administrative credentials under certain circumstances.

Vulnerable Product	Search on Vulmon	Subscribe to Product
siemens ccmw1025_firmware -
siemens cvms2025-ir_firmware -
siemens ccid1445-dn36_firmware -
siemens ccid1445-dn18_firmware -
siemens ccms2025_firmware -
siemens cfms2025_firmware -
siemens ccis1425_firmware -
siemens cfis1425_firmware -
siemens ccpw3025_firmware -
siemens cfmw3025_firmware -
siemens cvmw3025-ir_firmware -
siemens ccmw3025_firmware -
siemens cfmw1025_firmware -
siemens ccid1445-dn28_firmware -
siemens ccmd3025-dn18_firmware -

Surprise! Another insecure web-connected CCTV cam needs fixing

The Register • Richard Chirgwin • 21 Nov 2016

Siemens firmware emits admin login details to anyone who asks nicely

Siemens has issued a security patch for CCTV cameras that cough up their admin passwords to remote attackers. The cameras are now sold by Vanderbilt Industries, which acquired the camera business unit from the German industrial giant in 2015. The security bug lies in the web server in the gadgets' firmware, and is present in 16 product ranges under the Siemens brand, including dome, box and bullet-style cameras. If an attacker finds unpatched device on the internet and sends the right HTTP reque...

CVE-2016-9155

Vulnerability Summary

Vulnerability Trend

Recent Articles

References

Vulmon Search

About

Products

Connect