What is the CVSS score of CVE-2015-1595?

CVE-2015-1595 has a CVSS 2.0 base score of 4.3 (Medium). CVSS vector: AV:N/AC:M/Au:N/C:P/I:N/A:N. EPSS exploitation probability: 0.1%.

Spcanywhere CVE-2015-1595

MEDIUM

Information Exposure (CWE-200)

2015-03-07 cve@mitre.org

Apple Google Information Disclosure Siemens Spcanywhere

4.3

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:M/Au:N/C:P/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:M/Au:N/C:P/I:N/A:N

Attack Vector

Network

Attack Complexity

Confidentiality

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Mar 07, 2015 - 02:59 cve.org

MEDIUM 4.3

DescriptionCVE.org

The Siemens SPCanywhere application for Android and iOS does not use encryption during lookups of system ID to IP address mappings, which allows man-in-the-middle attackers to discover alarm IP addresses and spoof servers by intercepting the client-server data stream.

AnalysisAI

The Siemens SPCanywhere application for Android and iOS does not use encryption during lookups of system ID to IP address mappings, which allows man-in-the-middle attackers to discover alarm IP. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Exposure of Sensitive Information (CWE-200), which allows attackers to access sensitive data that should not be disclosed. The Siemens SPCanywhere application for Android and iOS does not use encryption during lookups of system ID to IP address mappings, which allows man-in-the-middle attackers to discover alarm IP addresses and spoof servers by intercepting the client-server data stream. Affected products include: Siemens Spcanywhere.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Minimize information in error messages, implement proper access controls, encrypt sensitive data at rest and in transit.