What is the CVSS score of CVE-2017-14262?

CVE-2017-14262 has a CVSS 3.0 base score of 8.1 (High). CVSS vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 21.0%.

Srn 1670D Firmware CVE-2017-14262

HIGH

Inadequate Encryption Strength (CWE-326)

2017-09-11 cve@mitre.org

Samsung Information Disclosure Srn 1670D Firmware Srn 1000 Firmware Srn 472S Firmware Srn 470D Firmware

8.1

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Sep 11, 2017 - 09:29 cve.org

HIGH 8.1

DescriptionCVE.org

AnalysisAI

On Samsung NVR devices, remote attackers can read the MD5 password hash of the 'admin' account via certain szUserName JSON data to cgi-bin/main-cgi, and login to the device with that hash in the. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Epss exploitation probability 21.0% and no vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-326. On Samsung NVR devices, remote attackers can read the MD5 password hash of the 'admin' account via certain szUserName JSON data to cgi-bin/main-cgi, and login to the device with that hash in the szUserPasswd parameter. Affected products include: Samsung Srn 1670D Firmware, Samsung Srn 1000 Firmware, Samsung Srn 472S Firmware, Samsung Srn 470D Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.