What is the CVSS score of CVE-2021-3791?

CVE-2021-3791 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Halo Camera Firmware CVE-2021-3791

MEDIUM

Insertion of Sensitive Information into Log File (CWE-532)

2021-11-12 psirt@lenovo.com

Information Disclosure Halo Camera Firmware Comfort 85 Connect Firmware Mbp3855 Firmware Focus 68 Firmware Focus 72R Firmware Cn28 Firmware Cn50 Firmware Comfort 40 Firmware Comfort 50 Connect Firmware Mbp4855 Firmware Mbp3667 Firmware Mbp669 Connect Firmware Lux 64 Firmware Lux 65 Firmware Connect View 65 Firmware Lux 85 Connect Firmware Ease44 Firmware Connect 20 Firmware Mbp6855 Firmware Cn40 Firmware Cn75 Firmware

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Nov 12, 2021 - 22:15 nvd

MEDIUM 6.5

DescriptionNVD

An information disclosure vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an unauthenticated attacker on the same subnet to download an encrypted log file containing sensitive information such as WiFi SSID and password.

AnalysisAI

An information disclosure vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an unauthenticated attacker on the same subnet to download an encrypted log file. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-532. An information disclosure vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an unauthenticated attacker on the same subnet to download an encrypted log file containing sensitive information such as WiFi SSID and password. Affected products include: Binatoneglobal Halo\+ Camera Firmware, Binatoneglobal Comfort 85 Connect Firmware, Binatoneglobal Mbp3855 Firmware, Binatoneglobal Focus 68 Firmware, Binatoneglobal Focus 72R Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.