PT-2017-4331 · Hikvision · Hikvision Ds-2Cd2432F-Iw

CVE-2017-14953 · Publicado 2017-01-12 · Atualizado 2024-08-05

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Hikvision DS-2CD2432F-IW (affected versions not specified)

Description: The issue is related to the use of a default SSID without WiFi encryption or authentication in Hikvision IP cameras. This can allow a remote attacker to gain elevated privileges. In a wired configuration, physically proximate attackers can trigger association with an arbitrary access point by leveraging the default SSID. The vendor considers this an increase to the attack surface rather than a vulnerability.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Encryption of Sensitive Data

Enumeração de Fraquezas

CWE-311

Identificadores relacionados

BDU:2024-06775

CVE-2017-14953

Produtos afetados

Hikvision Ds-2Cd2432F-Iw

Referências · 9

• https://nvd.nist.gov/vuln/detail/CVE-2017-14953 · Nota de Segurança
• https://t.me/cvenotify/89270 · Publicação no Telegram
• http://seclists.org/fulldisclosure/2017/Nov/43 · Nota
• https://t.me/cvenotify/83672 · Publicação no Telegram
• http://packetstormsecurity.com/files/145131/HikVision-Wi-Fi-IP-Camera-Wireless-Access-Point-State.html · Nota
• https://packetstormsecurity.com/files/145131/HikVision-Wi-Fi-IP-Camera-Wireless-Access-Point-State.html · Nota
• https://osv.dev/vulnerability/CVE-2017-14953 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2024-06775 · Nota de Segurança
• https://seclists.org/fulldisclosure/2017/Nov/43 · Nota