What is the CVSS score of CVE-2016-9155?

CVE-2016-9155 has a CVSS 3.0 base score of 9.8 (Critical). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.9%.

Is there a patch available for CVE-2016-9155?

Yes, a patch is available for CVE-2016-9155. Update the affected software to the latest version immediately.

Ccid1445 Dn18 Firmware CVE-2016-9155

CRITICAL

Improper Access Control (CWE-284)

2016-11-22 productcert@siemens.com

Siemens Authentication Bypass Ccid1445 Dn18 Firmware Ccid1445 Dn28 Firmware Ccid1445 Dn36 Firmware Ccis1425 Firmware Ccmd3025 Dn18 Firmware Ccms2025 Firmware Ccmw1025 Firmware Ccmw3025 Firmware Ccpw3025 Firmware Cfis1425 Firmware Cfms2025 Firmware Cfmw1025 Firmware Cfmw3025 Firmware Cvms2025 Ir Firmware Cvmw3025 Ir Firmware

9.8

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Nov 22, 2016 - 11:59 cve.org

CRITICAL 9.8

DescriptionCVE.org

The following SIEMENS branded IP Camera Models CCMW3025, CVMW3025-IR, CFMW3025 prior to version 1.41_SP18_S1; CCPW3025, CCPW5025 prior to version 0.1.73_S1; CCMD3025-DN18 prior to version v1.394_S1; CCID1445-DN18, CCID1445-DN28, CCID1145-DN36, CFIS1425, CCIS1425, CFMS2025, CCMS2025, CVMS2025-IR, CFMW1025, CCMW1025 prior to version v2635_SP1 could allow an attacker with network access to the web server to obtain administrative credentials under certain circumstances.

AnalysisAI

The following SIEMENS branded IP Camera Models CCMW3025, CVMW3025-IR, CFMW3025 prior to version 1.41_SP18_S1; CCPW3025, CCPW5025 prior to version 0.1.73_S1; CCMD3025-DN18 prior to version v1.394_S1;. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-284. The following SIEMENS branded IP Camera Models CCMW3025, CVMW3025-IR, CFMW3025 prior to version 1.41_SP18_S1; CCPW3025, CCPW5025 prior to version 0.1.73_S1; CCMD3025-DN18 prior to version v1.394_S1; CCID1445-DN18, CCID1445-DN28, CCID1145-DN36, CFIS1425, CCIS1425, CFMS2025, CCMS2025, CVMS2025-IR, CFMW1025, CCMW1025 prior to version v2635_SP1 could allow an attacker with network access to the web server to obtain administrative credentials under certain circumstances. Affected products include: Siemens Ccid1445-Dn18 Firmware, Siemens Ccid1445-Dn28 Firmware, Siemens Ccid1445-Dn36 Firmware, Siemens Ccis1425 Firmware, Siemens Ccmd3025-Dn18 Firmware. Version information: version 1.41.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.