Lucene search

MitreCVE-2019-20466

HistoryApr 02, 2021 - 4:15 p.m.

CVE-2019-20466

2021-04-0216:15:13

CWE-916

mitre

web.nvd.nist.gov

cve-2019-20466

security camera

local attack

default account

weak password hash

root access

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

High

EPSS

Percentile

5.1%

JSON

An issue was discovered on Sannce Smart HD Wifi Security Camera EAN 2 950004 595317 devices. A local attacker with the “default” account is capable of reading the /etc/passwd file, which contains a weakly hashed root password. By taking this hash and cracking it, the attacker can obtain root rights on the device.

Affected configurations

Nvd

Node

sanncesmart_hd_wifi_security_camera_ean_2_950004_595317_firmwareMatch-

AND

sanncesmart_hd_wifi_security_camera_ean_2_950004_595317Match-

VendorProductVersionCPE
sanncesmart_hd_wifi_security_camera_ean_2_950004_595317_firmware-cpe:2.3:o:sannce:smart_hd_wifi_security_camera_ean_2_950004_595317_firmware:-:*:*:*:*:*:*:*
sanncesmart_hd_wifi_security_camera_ean_2_950004_595317-cpe:2.3:h:sannce:smart_hd_wifi_security_camera_ean_2_950004_595317:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
sannce	smart_hd_wifi_security_camera_ean_2_950004_595317_firmware	-	cpe:2.3:o:sannce:smart_hd_wifi_security_camera_ean_2_950004_595317_firmware:-:::::::*
sannce	smart_hd_wifi_security_camera_ean_2_950004_595317	-	cpe:2.3:h:sannce:smart_hd_wifi_security_camera_ean_2_950004_595317:-:::::::*

References

seclists.org/fulldisclosure/2024/Jul/14

www.eurofins-cybersecurity.com/news/connected-devices-baby-monitors-part-2/

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for CVE-2019-20466