Published: 10/10/2018 Updated: 09/10/2019

CVSS v2 Base Score: 6.4 | Impact Score: 4.9 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 570

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N

All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server do not encrypt all device communication. This includes the XMeye service and firmware update communication. This could allow an malicious user to eavesdrop on video feeds, steal XMeye login credentials, or impersonate the update server with malicious update code.

Vulnerable Product	Search on Vulmon	Subscribe to Product
xiongmaitech xmeye p2p cloud server -

XMeye P2P Cloud used with Xiongmai IP Cameras, NVRs and DVRs suffer from predictable Cloud IDs, default admin password, and various other issues that can result in remote code execution ...

Full Disclosure mailing list archives   By Date By Thread </form>    SEC Consult SA-20181009-0 :: Remote Code Execution via XMeye P2P Cloud in Xiongmai IP Cameras, NVRs and DVRs incl 3rd ...

CWE-311 https://ics-cert.us-cert.gov/advisories/ICSA-18-282-06 https://nvd.nist.gov https://packetstormsecurity.com/files/149749/XMeye-P2P-Cloud-Remote-Code-Execution-Integrity-Issues.html

CVE-2018-17915

Vulnerability Summary

Vulnerability Trend

Exploits

Mailing Lists

References

Vulmon Search

About

Products

Connect