CVE-2015-2909

Published: Feb 6, 2020Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Dedicated Micros DV-IP Express, SD Advanced, SD, EcoSense, and DS2 devices rely on a GUI warning to help ensure that the administrator configures login credentials, which makes it easier for remote attackers to obtain access by leveraging situations in which this warning was not heeded. NOTE: the vendor states "The user is presented with clear warnings on the GUI that they should set usernames and passwords."

Affected (20)

Products: Netvu: Dv Ip Express Firmware, Sd Advanced Sdhd Firmware, Sd Advanced 8/12/16 Vga Firmware, Sd Advanced Closed Iptv (m3u) Firmware, Sd Advanced Non Closed Iptv (m3u) Firmware, Sd Advanced Nvr Firmware, Sd 32 (m3g) Firmware, Sd 32 (m3h) Firmware, Sd 4 (m3s) Firmware, Sd 4 (m3t) Firmware, Sd 8/12/16 No Kbd (m3r) Firmware, Sd 8/12/16 No Kbd (m3s) Firmware, Sd 8/16 Front Panel Kbd (m3r) Firmware, Sd 8/16 Front Panel Kbd (m3u) Firmware, Ecosense 4/8/16 (m4t) Firmware, Ds2 (dvtr) Firmware, Ds2 (dvtu) Firmware, Ds2 (dvtx) Firmware, Ds2 (dvtx) Netvu Connected Firmware, Ds2 (m2ip) Firmware

Netvu

20 products

Dv Ip Express Firmware

Sd Advanced Sdhd Firmware

Sd Advanced 8/12/16 Vga Firmware

Sd Advanced Closed Iptv (m3u) Firmware

Sd Advanced Non Closed Iptv (m3u) Firmware

Sd Advanced Nvr Firmware

Sd 8/12/16 No Kbd (m3r) Firmware

Sd 8/12/16 No Kbd (m3s) Firmware

Sd 8/16 Front Panel Kbd (m3r) Firmware

Sd 8/16 Front Panel Kbd (m3u) Firmware

Ecosense 4/8/16 (m4t) Firmware

Ds2 (dvtr) Firmware

Ds2 (dvtu) Firmware

Ds2 (dvtx) Firmware

Ds2 (dvtx) Netvu Connected Firmware

Ds2 (m2ip) Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netvu Dv Ip Express Firmware	All versions

Running on/with	Platform Versions
Netvu Dv Ip Express	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netvu Sd Advanced Sdhd Firmware	All versions

Running on/with	Platform Versions
Netvu Sd Advanced Sdhd	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netvu Sd Advanced 8/12/16 Vga Firmware	All versions

Running on/with	Platform Versions
Netvu Sd Advanced 8/12/16 Vga	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netvu Sd Advanced Closed Iptv (m3u) Firmware	All versions

Running on/with	Platform Versions
Netvu Sd Advanced Closed Iptv (m3u)	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netvu Sd Advanced Non Closed Iptv (m3u) Firmware	All versions

Running on/with	Platform Versions
Netvu Sd Advanced Non Closed Iptv (m3u)	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netvu Sd Advanced Nvr Firmware	All versions

Running on/with	Platform Versions
Netvu Sd Advanced Nvr	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netvu Sd 32 (m3g) Firmware	All versions

Running on/with	Platform Versions
Netvu Sd 32 (m3g)	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netvu Sd 32 (m3h) Firmware	All versions

Running on/with	Platform Versions
Netvu Sd 32 (m3h)	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netvu Sd 4 (m3s) Firmware	All versions

Running on/with	Platform Versions
Netvu Sd 4 (m3s)	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netvu Sd 4 (m3t) Firmware	All versions

Running on/with	Platform Versions
Netvu Sd 4 (m3t)	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netvu Sd 8/12/16 No Kbd (m3r) Firmware	All versions

Running on/with	Platform Versions
Netvu Sd 8/12/16 No Kbd (m3r)	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netvu Sd 8/12/16 No Kbd (m3s) Firmware	All versions

Running on/with	Platform Versions
Netvu Sd 8/12/16 No Kbd (m3s)	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netvu Sd 8/16 Front Panel Kbd (m3r) Firmware	All versions

Running on/with	Platform Versions
Netvu Sd 8/16 Front Panel Kbd (m3r)	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netvu Sd 8/16 Front Panel Kbd (m3u) Firmware	All versions

Running on/with	Platform Versions
Netvu Sd 8/16 Front Panel Kbd (m3u)	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netvu Ecosense 4/8/16 (m4t) Firmware	All versions

Running on/with	Platform Versions
Netvu Ecosense 4/8/16 (m4t)	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netvu Ds2 (dvtr) Firmware	All versions

Running on/with	Platform Versions
Netvu Ds2 (dvtr)	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netvu Ds2 (dvtu) Firmware	All versions

Running on/with	Platform Versions
Netvu Ds2 (dvtu)	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netvu Ds2 (dvtx) Firmware	All versions

Running on/with	Platform Versions
Netvu Ds2 (dvtx)	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netvu Ds2 (dvtx) Netvu Connected Firmware	All versions

Running on/with	Platform Versions
Netvu Ds2 (dvtx) Netvu Connected	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netvu Ds2 (m2ip) Firmware	All versions

Running on/with	Platform Versions
Netvu Ds2 (m2ip)	All versions

Related CWEs

CWE-269

Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

References (4)

http://cybergibbons.com/security-2/shodan-searches/interesting-shodan-searches-sd-advanced-dvrs/

Source: cret@cert.org

ExploitThird Party Advisory

http://www.kb.cert.org/vuls/id/276148

Source: cret@cert.org

Third Party AdvisoryUS Government Resource

http://cybergibbons.com/security-2/shodan-searches/interesting-shodan-searches-sd-advanced-dvrs/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

http://www.kb.cert.org/vuls/id/276148

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryUS Government Resource

Timeline

No history available yet.