What is the CVSS score of CVE-2014-1901?

CVE-2014-1901 has a CVSS 2.0 base score of 6.8 (Medium). CVSS vector: AV:N/AC:L/Au:S/C:N/I:N/A:C. EPSS exploitation probability: 0.6%.

Yceb03 Firmware CVE-2014-1901

MEDIUM

Improper Input Validation (CWE-20)

2015-05-14 cve@mitre.org

Denial Of Service Yceb03 Firmware Ycb004 Firmware Ycb002 Firmware Ycbl03 Firmware Ycbl03 Ycblb3 Firmware Ycblb3 Yck002 Firmware Ycblhd5 Firmware Ycw003 Firmware Ycw001 Firmware Ycw002 Firmware Ycb001 Firmware Ycw004 Firmware Ycw004 Yck003 Firmware Yck004 Firmware Ycb003 Firmware

6.8

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

6.8 MEDIUM

AV:N/AC:L/Au:S/C:N/I:N/A:C

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:L/Au:S/C:N/I:N/A:C

Attack Vector

Network

Attack Complexity

Low

Confidentiality

None

Integrity

None

Availability

Lifecycle Timeline

CVE Published

May 14, 2015 - 00:59 cve.org

MEDIUM 6.8

DescriptionCVE.org

Y-Cam camera models SD range YCB003, YCK003, and YCW003; S range YCB004, YCK004, YCW004; EyeBall YCEB03; Bullet VGA YCBL03 and YCBLB3; Bullet HD 720 YCBLHD5; Y-cam Classic Range YCB002, YCK002, and YCW003; and Y-cam Original Range YCB001, YCW001, running firmware 4.30 and earlier, allow remote authenticated users to cause a denial of service (reboot) via a malformed (1) path parameter to en/store_main.asp, (2) item parameter to en/account/accedit.asp, or (3) emailid parameter to en/smtpclient.asp. NOTE: this issue can be exploited without authentication by leveraging CVE-2014-1900.

AnalysisAI

Y-Cam camera models SD range YCB003, YCK003, and YCW003; S range YCB004, YCK004, YCW004; EyeBall YCEB03; Bullet VGA YCBL03 and YCBLB3; Bullet HD 720 YCBLHD5; Y-cam Classic Range YCB002, YCK002, and. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-20. Y-Cam camera models SD range YCB003, YCK003, and YCW003; S range YCB004, YCK004, YCW004; EyeBall YCEB03; Bullet VGA YCBL03 and YCBLB3; Bullet HD 720 YCBLHD5; Y-cam Classic Range YCB002, YCK002, and YCW003; and Y-cam Original Range YCB001, YCW001, running firmware 4.30 and earlier, allow remote authenticated users to cause a denial of service (reboot) via a malformed (1) path parameter to en/store_main.asp, (2) item parameter to en/account/accedit.asp, or (3) emailid parameter to en/smtpclient.asp. NOTE: this issue can be exploited without authentication by leveraging CVE-2014-1900. Affected products include: Y-Cam Yceb03 Firmware, Y-Cam Ycb004 Firmware, Y-Cam Ycb002 Firmware, Y-Cam Ycbl03 Firmware, Y-Cam Ycbl03.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.