CVE-2017-14953

** DISPUTED ** HikVision Wi-Fi IP cameras, when used in a wired configuration, allow physically proximate attackers to trigger association with an arbitrary access point by leveraging a default SSID with no WiFi encryption or authentication. NOTE: Vendor states that this is not a vulnerability, but more an increase to the attack surface of the product.

CVSS v3 6.5 MEDIUM
CVSS v2.0 3.3 LOW

6.5^/10

CVSS v3 : MEDIUM

Vector : AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability : 2.8 / Impact : 3.6

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

3.3^/10

CVSS v2.0 : LOW

Vector : AV:A/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 6.5 / Impact : 2.9

Access Vector ADJACENT_NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://packetstormsecurity.com/files/145131/HikVision-Wi-Fi-IP-Camera-Wireless-Access-Point-State.html	Third Party Advisory VDB Entry
http://seclists.org/fulldisclosure/2017/Nov/43	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:hikvision:ds-2cd2432f-iw_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:hikvision:ds-2cd2432f-iw:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2017-12-01 17:29

Updated : 2024-08-05 20:15

NVD link : CVE-2017-14953

Mitre link : CVE-2017-14953

CVE.ORG link : CVE-2017-14953

JSON object : View

Products Affected

hikvision

ds-2cd2432f-iw_firmware
ds-2cd2432f-iw

CWE

CWE-311

Missing Encryption of Sensitive Data

{"id": "CVE-2017-14953", "cveTags": [{"tags": ["disputed"], "sourceIdentifier": "cve@mitre.org"}], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.3, "accessVector": "ADJACENT_NETWORK", "vectorString": "AV:A/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.5, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2017-12-01T17:29:00.387", "references": [{"url": "http://packetstormsecurity.com/files/145131/HikVision-Wi-Fi-IP-Camera-Wireless-Access-Point-State.html", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://seclists.org/fulldisclosure/2017/Nov/43", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-311"}]}], "descriptions": [{"lang": "en", "value": "HikVision Wi-Fi IP cameras, when used in a wired configuration, allow physically proximate attackers to trigger association with an arbitrary access point by leveraging a default SSID with no WiFi encryption or authentication. NOTE: Vendor states that this is not a vulnerability, but more an increase to the attack surface of the product"}, {"lang": "es", "value": "** EN DISPUTA ** Las c\u00e1maras IP HikVision, cuando se utilizan en una configuraci\u00f3n por cable, permiten que los atacantes cercanos f\u00edsicamente desencadenen la asociaci\u00f3n con un punto de acceso arbitrario utilizando un SSID por defecto sin cifrado o autenticaci\u00f3n de wifi. NOTA: El vendedor afirma que esto no es una vulnerabilidad, sino m\u00e1s bien un aumento de la superficie de ataque del producto."}], "lastModified": "2024-08-05T20:15:26.970", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:hikvision:ds-2cd2432f-iw_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "21201840-02CF-4E86-B6C1-770773EA71BE", "versionEndExcluding": "5.4.5"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:hikvision:ds-2cd2432f-iw:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "B6C6812E-65E0-4459-85E9-504BFCB09C19"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}