What is the CVSS score of CVE-2014-1900?

CVE-2014-1900 has a CVSS 2.0 base score of 5.0 (Medium). CVSS vector: AV:N/AC:L/Au:N/C:P/I:N/A:N. EPSS exploitation probability: 0.3%.

Is there a public PoC exploit available for CVE-2014-1900?

Yes, a public proof-of-concept exploit is available for CVE-2014-1900. Prioritise patching immediately. EPSS: 0.3%.

Is there a patch available for CVE-2014-1900?

Yes, a patch is available for CVE-2014-1900. Update the affected software to the latest version immediately.

Ycb002 Firmware CVE-2014-1900

MEDIUM

Information Exposure (CWE-200)

2015-05-14 cve@mitre.org

Information Disclosure Ycb002 Firmware Ycb004 Firmware Ycw003 Firmware Ycb001 Firmware Ycblhd5 Firmware Ycbl03 Firmware Ycbl03 Ycblb3 Firmware Ycblb3 Ycw001 Firmware Yck004 Firmware Yck003 Firmware Ycw004 Firmware Ycw004 Ycb003 Firmware Yceb03 Firmware Ycw002 Firmware Yck002 Firmware

5.0

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

5.0 MEDIUM

AV:N/AC:L/Au:N/C:P/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:L/Au:N/C:P/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Confidentiality

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

May 14, 2015 - 00:59 cve.org

MEDIUM 5.0

DescriptionCVE.org

Y-Cam camera models SD range YCB003, YCK003, and YCW003; S range YCB004, YCK004, YCW004; EyeBall YCEB03; Bullet VGA YCBL03 and YCBLB3; Bullet HD 720 YCBLHD5; Y-cam Classic Range YCB002, YCK002, and YCW003; and Y-cam Original Range YCB001, YCW001, running firmware 4.30 and earlier, allow remote attackers to bypass authentication and obtain sensitive information via a leading "/./" in a request to en/account/accedit.asp.

AnalysisAI

Y-Cam camera models SD range YCB003, YCK003, and YCW003; S range YCB004, YCK004, YCW004; EyeBall YCEB03; Bullet VGA YCBL03 and YCBLB3; Bullet HD 720 YCBLHD5; Y-cam Classic Range YCB002, YCK002, and. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified as Exposure of Sensitive Information (CWE-200), which allows attackers to access sensitive data that should not be disclosed. Y-Cam camera models SD range YCB003, YCK003, and YCW003; S range YCB004, YCK004, YCW004; EyeBall YCEB03; Bullet VGA YCBL03 and YCBLB3; Bullet HD 720 YCBLHD5; Y-cam Classic Range YCB002, YCK002, and YCW003; and Y-cam Original Range YCB001, YCW001, running firmware 4.30 and earlier, allow remote attackers to bypass authentication and obtain sensitive information via a leading "/./" in a request to en/account/accedit.asp. Affected products include: Y-Cam Ycb002 Firmware, Y-Cam Ycb004 Firmware, Y-Cam Ycw003 Firmware, Y-Cam Ycb001 Firmware, Y-Cam Ycblhd5 Firmware.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Minimize information in error messages, implement proper access controls, encrypt sensitive data at rest and in transit.