What is the CVSS score of CVE-2017-14263?

CVE-2017-14263 has a CVSS 3.0 base score of 8.1 (High). CVSS vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 24.4%.

Session Fixation CVE-2017-14263

HIGH

Session Fixation (CWE-384)

2017-09-11 cve@mitre.org

Session Fixation Honeywell Information Disclosure Enterprise Dvr Firmware Maxpro Nvr Hybrid Se Firmware Maxpro Nvr Hybrid Xe Firmware Maxpro Nvr Se Firmware Maxpro Nvr Xe Firmware Fusion Iv Rev C Firmware Maxpro Nvr Pe Firmware

8.1

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Sep 11, 2017 - 09:29 cve.org

HIGH 8.1

DescriptionCVE.org

Honeywell NVR devices allow remote attackers to create a user account in the admin group by leveraging access to a guest account to obtain a session ID, and then sending that session ID in a userManager.addUser request to the /RPC2 URI. The attacker can login to the device with that new user account to fully control the device.

AnalysisAI

Honeywell NVR devices allow remote attackers to create a user account in the admin group by leveraging access to a guest account to obtain a session ID, and then sending that session ID in a. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Epss exploitation probability 24.4% and no vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-384. Honeywell NVR devices allow remote attackers to create a user account in the admin group by leveraging access to a guest account to obtain a session ID, and then sending that session ID in a userManager.addUser request to the /RPC2 URI. The attacker can login to the device with that new user account to fully control the device. Affected products include: Honeywell Enterprise Dvr Firmware, Honeywell Maxpro Nvr Hybrid Se Firmware, Honeywell Maxpro Nvr Hybrid Xe Firmware, Honeywell Maxpro Nvr Se Firmware, Honeywell Maxpro Nvr Xe Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.