CVE-2017-14262

Published: Sep 11, 2017Modified: May 13, 2026

8.1

Vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.2 / Impact: 5.9

Source: NVD

Description

On Samsung NVR devices, remote attackers can read the MD5 password hash of the 'admin' account via certain szUserName JSON data to cgi-bin/main-cgi, and login to the device with that hash in the szUserPasswd parameter.

Affected (4)

Products: Samsung: Srn 1670d Firmware, Srn 1000 Firmware, Srn 472s Firmware, Srn 470d Firmware

4 products

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Samsung Srn 1670d Firmware	All versions

Running on/with	Platform Versions
Samsung Srn 1670d	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Samsung Srn 1000 Firmware	All versions

Running on/with	Platform Versions
Samsung Srn 1000	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Samsung Srn 472s Firmware	All versions

Running on/with	Platform Versions
Samsung Srn 472s	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Samsung Srn 470d Firmware	All versions

Running on/with	Platform Versions
Samsung Srn 470d	All versions

Related CWEs

CWE-326

Inadequate Encryption Strength

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

References (2)

https://github.com/zzz66686/Samsung_NVR_vul

Source: cve@mitre.org

Third Party Advisory

https://github.com/zzz66686/Samsung_NVR_vul

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.