PT-2020-7825 · Dedicated Micros · Ecosense+4

Andrew Tierney · Published 2020-02-06 · Updated 2020-02-12 · CVE-2015-2909

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Dedicated Micros DV-IP Express, SD Advanced, SD, EcoSense, and DS2 devices (affected versions not specified)

Description: The issue arises because the devices rely on a GUI warning to ensure administrators configure login credentials. This makes it easier for remote attackers to obtain access in situations where the warning was not heeded. The vendor notes that clear warnings are presented on the GUI to set usernames and passwords.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2015-2909

Affected Products

Ds2

Dedicated Micros Dv-Ip Express

Ecosense

Sd

Sd Advanced

References · 4

• 🔥 http://cybergibbons.com/security-2/shodan-searches/interesting-shodan-searches-sd-advanced-dvrs · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-2909 · Security Note
• http://kb.cert.org/vuls/id/276148 · Note
• https://t.me/cvenotify/842 · Telegram Post