What is the CVSS score of CVE-2019-12919?

CVE-2019-12919 has a CVSS 3.0 base score of 5.5 (Medium). CVSS vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Is there a public PoC exploit available for CVE-2019-12919?

Yes, a public proof-of-concept exploit is available for CVE-2019-12919. Prioritise patching immediately. EPSS: 0.4%.

Clever Dog Smart Camera Panorama Dog 2W Firmware CVE-2019-12919

MEDIUM

Missing Authentication for Critical Function (CWE-306)

2019-06-20 cve@mitre.org

Authentication Bypass Clever Dog Smart Camera Panorama Dog 2W Firmware Clever Dog Smart Camera Plus Dog 2W V4 Firmware

5.5

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Jun 20, 2019 - 19:15 nvd

MEDIUM 5.5

DescriptionNVD

On Shenzhen Cylan Clever Dog Smart Camera DOG-2W and DOG-2W-V4 devices, an attacker on the local network has unauthenticated access to the internal SD card via the HTTP service on port 8000. The HTTP web server on the camera allows anyone to view or download the video archive recorded and saved on the external memory card attached to the device.

AnalysisAI

On Shenzhen Cylan Clever Dog Smart Camera DOG-2W and DOG-2W-V4 devices, an attacker on the local network has unauthenticated access to the internal SD card via the HTTP service on port 8000. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Missing Authentication for Critical Function (CWE-306), which allows attackers to access critical functionality without authentication. On Shenzhen Cylan Clever Dog Smart Camera DOG-2W and DOG-2W-V4 devices, an attacker on the local network has unauthenticated access to the internal SD card via the HTTP service on port 8000. The HTTP web server on the camera allows anyone to view or download the video archive recorded and saved on the external memory card attached to the device. Affected products include: Cylan Clever Dog Smart Camera Panorama Dog-2W Firmware, Cylan Clever Dog Smart Camera Plus Dog-2W-V4 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Require authentication for all sensitive operations, implement defense in depth.