What is the CVSS score of CVE-2019-12920?

CVE-2019-12920 has a CVSS 3.0 base score of 9.8 (Critical). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 2.3%.

Is there a public PoC exploit available for CVE-2019-12920?

Yes, a public proof-of-concept exploit is available for CVE-2019-12920. Prioritise patching immediately. EPSS: 2.3%.

Clever Dog Smart Camera Panorama Dog 2W Firmware CVE-2019-12920

CRITICAL

Use of Hard-coded Credentials (CWE-798)

2019-06-20 cve@mitre.org

Authentication Bypass Clever Dog Smart Camera Panorama Dog 2W Firmware Clever Dog Smart Camera Plus Dog 2W V4 Firmware

9.8

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Jun 20, 2019 - 19:15 nvd

CRITICAL 9.8

DescriptionNVD

On Shenzhen Cylan Clever Dog Smart Camera DOG-2W and DOG-2W-V4 devices, an attacker on the network can login remotely to the camera and gain root access. The device ships with a hardcoded 12345678 password for the root account, accessible from a TELNET login prompt.

AnalysisAI

On Shenzhen Cylan Clever Dog Smart Camera DOG-2W and DOG-2W-V4 devices, an attacker on the network can login remotely to the camera and gain root access. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Use of Hard-coded Credentials (CWE-798), which allows attackers to gain access using credentials embedded in source code. On Shenzhen Cylan Clever Dog Smart Camera DOG-2W and DOG-2W-V4 devices, an attacker on the network can login remotely to the camera and gain root access. The device ships with a hardcoded 12345678 password for the root account, accessible from a TELNET login prompt. Affected products include: Cylan Clever Dog Smart Camera Panorama Dog-2W Firmware, Cylan Clever Dog Smart Camera Plus Dog-2W-V4 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Remove hard-coded credentials, use environment variables or secrets management, rotate exposed credentials immediately.