PT-2018-13623 · Amcrest · Amcrest Networked Devices

Jack M. Mckenna · Publicado 2018-09-05 · Atualizado 2019-10-03 · CVE-2018-16546

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Amcrest networked devices (affected versions not specified)

Description The issue concerns Amcrest networked devices using the same hardcoded SSL private key across different installations. This allows remote attackers to bypass cryptographic protection by leveraging knowledge of the key from another installation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2018-16546

Produtos afetados

Amcrest Networked Devices

Referências · 3

• https://seclists.org/bugtraq/2018/Sep/6 · Nota
• https://osv.dev/vulnerability/CVE-2018-16546 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-16546 · Nota de Segurança