CVE-2017-10718

{"id": "CVE-2017-10718", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2019-06-17T22:15:09.903", "references": [{"url": "http://packetstormsecurity.com/files/153241/Shekar-Endoscope-Weak-Default-Settings-Memory-Corruption.html", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Shekar_boriscope_sec_issues.pdf", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://seclists.org/bugtraq/2019/Jun/8", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-255"}]}], "descriptions": [{"lang": "en", "value": "Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that any malicious user connecting to the device can change the default SSID and password thereby denying the owner an access to his/her own device. This device acts as an Endoscope camera that allows its users to use it in various industrial systems and settings, car garages, and also in some cases in the medical clinics to get access to areas that are difficult for a human being to reach. Any breach of this system can allow an attacker to get access to video feed and pictures viewed by that user and might allow them to get a foot hold in air gapped networks especially in case of nation critical infrastructure/industries."}, {"lang": "es", "value": "Recientemente, como parte de la investigaci\u00f3n sobre dispositivos IoT en el firmware m\u00e1s reciente para el Endoscopio Shekar , cualquier usuario malicioso que se conecte al dispositivo puede cambiar el SSID y la contrase\u00f1a por defecto, lo que le niega al propietario el acceso a su propio dispositivo. Este dispositivo act\u00faa como una c\u00e1mara endosc\u00f3pica que permite a sus usuarios utilizarla en diversos sistemas y configuraciones industriales, talleres de coches y tambi\u00e9n, en ciertos casos, en cl\u00ednicas m\u00e9dicas para poder acceder a \u00e1reas que son dif\u00edciles de alcanzar para un ser humano. Cualquier violaci\u00f3n de este sistema puede permitirle a un atacante obtener acceso a fuentes de video e im\u00e1genes que visualiza ese usuario, y podr\u00eda permitirle tener un pie firme en redes con protecci\u00f3n Air Grap, especialmente en el caso de infraestructuras/industrias cr\u00edticas para la naci\u00f3n."}], "lastModified": "2019-06-20T18:08:54.060", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:ishekar:endoscope_camera_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4D620235-1706-4284-A45B-308C32A8DB90"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:ishekar:endoscope_camera:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "46805FDE-1451-44FF-86EF-B52C0A39F6ED"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}