PT-2017-6619 · Philips · Philips In.Sight B120/37

Published 2017-04-10 · Updated 2017-04-14 · CVE-2015-2883

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Philips In.Sight B120/37

Description The issue is related to the Weaved cloud web service and involves XSS. This can be demonstrated by the name parameter to "deviceSettings.php" or "shareDevice.php" endpoints.

Recommendations For Philips In.Sight B120/37, avoid using the name parameter in the affected "deviceSettings.php" or "shareDevice.php" endpoints until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2015-2883

Affected Products

Philips In.Sight B120/37

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2015-2883 · Security Note
• https://community.rapid7.com/community/infosec/blog/2015/09/02/iotsec-disclosure-10-new-vulns-for-several-video-baby-monitors · Note