CVE-2022-40939

In certain Secustation products the administrator account password can be read. This affects V2.5.5.3116-S50-SMA-B20171107A, V2.3.4.1301-M20-TSA-B20150617A, V2.5.5.3116-S50-RXA-B20180502A, V2.5.5.3116-S50-SMA-B20190723A, V2.5.5.3116-S50-SMB-B20161012A, V2.3.4.2103-S50-NTD-B20170508B, V2.5.5.3116-S50-SMB-B20160601A, V2.5.5.2601-S50-TSA-B20151229A, and V2.5.5.3116-S50-SMA-B20170217.

CVSS v3 4.9 MEDIUM

4.9^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://cdsbz.gitbook.io/untitled/secustion-camera-vulnerability-recurrence	Exploit Third Party Advisory
https://cdsbz.gitbook.io/untitled/secustion-camera-vulnerability-recurrence	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:o:secu:secustation_firmware:2.3.4.1301-m20-tsa-b20150617a:::::::*
	cpe:2.3:o:secu:secustation_firmware:2.3.4.2103-s50-ntd-b20170508b:::::::*
	cpe:2.3:o:secu:secustation_firmware:2.5.5.2601-s50-tsa-b20151229a:::::::*
	cpe:2.3:o:secu:secustation_firmware:2.5.5.3116-s50-rxa-b20180502a:::::::*
	cpe:2.3:o:secu:secustation_firmware:2.5.5.3116-s50-sma-b20170217:::::::*
	cpe:2.3:o:secu:secustation_firmware:2.5.5.3116-s50-sma-b20171107a:::::::*
	cpe:2.3:o:secu:secustation_firmware:2.5.5.3116-s50-sma-b20190723a:::::::*
	cpe:2.3:o:secu:secustation_firmware:2.5.5.3116-s50-smb-b20160601a:::::::*
	cpe:2.3:o:secu:secustation_firmware:2.5.5.3116-s50-smb-b20161012a:::::::*

cpe:2.3:h:secu:secustation:-:*:*:*:*:*:*:*

History

21 Nov 2024, 07:22

Type	Values Removed	Values Added
References	~~() https://cdsbz.gitbook.io/untitled/secustion-camera-vulnerability-recurrence - Exploit, Third Party Advisory~~	() https://cdsbz.gitbook.io/untitled/secustion-camera-vulnerability-recurrence - Exploit, Third Party Advisory

Information

Published : 2022-12-08 17:15

Updated : 2025-04-22 21:15

NVD link : CVE-2022-40939

Mitre link : CVE-2022-40939

CVE.ORG link : CVE-2022-40939

JSON object : View

Products Affected

secu

secustation_firmware
secustation

CWE

CWE-319

Cleartext Transmission of Sensitive Information

{"id": "CVE-2022-40939", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.2}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.2}]}, "published": "2022-12-08T17:15:10.493", "references": [{"url": "https://cdsbz.gitbook.io/untitled/secustion-camera-vulnerability-recurrence", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://cdsbz.gitbook.io/untitled/secustion-camera-vulnerability-recurrence", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-319"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-319"}]}], "descriptions": [{"lang": "en", "value": "In certain Secustation products the administrator account password can be read. This affects V2.5.5.3116-S50-SMA-B20171107A, V2.3.4.1301-M20-TSA-B20150617A, V2.5.5.3116-S50-RXA-B20180502A, V2.5.5.3116-S50-SMA-B20190723A, V2.5.5.3116-S50-SMB-B20161012A, V2.3.4.2103-S50-NTD-B20170508B, V2.5.5.3116-S50-SMB-B20160601A, V2.5.5.2601-S50-TSA-B20151229A, and V2.5.5.3116-S50-SMA-B20170217."}, {"lang": "es", "value": "En determinados productos de Secusation se puede leer la contrase\u00f1a de la cuenta de administrador. Esto afecta a:\nV2.5.5.3116-S50-SMA-B20171107A, \nV2.3.4.1301-M20-TSA-B20150617A, \nV2.5.5.3116-S50-RXA-B20180502A, \nV2.5.5.3116-S50-SMA-B20190723A , \nV2.5.5.3116-S50-SMB-B20161012A, \nV2.3.4.2103-S50-NTD-B20170508B, \nV2.5.5.3116-S50-SMB-B20160601A, \nV2.5.5.2601-S50-TSA-B20151229A y \nV2.5.5.3116-S50-SMA-B20170217."}], "lastModified": "2025-04-22T21:15:43.420", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:secu:secustation_firmware:2.3.4.1301-m20-tsa-b20150617a:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DA4DECB1-2B10-4693-B1E3-CAD2B12EF8EB"}, {"criteria": "cpe:2.3:o:secu:secustation_firmware:2.3.4.2103-s50-ntd-b20170508b:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "16387C06-6BED-4717-BB31-5C1F90B88216"}, {"criteria": "cpe:2.3:o:secu:secustation_firmware:2.5.5.2601-s50-tsa-b20151229a:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BEDACFB2-E5B5-4A34-8808-57F72D904BA7"}, {"criteria": "cpe:2.3:o:secu:secustation_firmware:2.5.5.3116-s50-rxa-b20180502a:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "965AA07F-DD63-417A-AE13-C09CCA9EBCD2"}, {"criteria": "cpe:2.3:o:secu:secustation_firmware:2.5.5.3116-s50-sma-b20170217:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "239F6C71-1D8D-4954-A660-C3DB35455968"}, {"criteria": "cpe:2.3:o:secu:secustation_firmware:2.5.5.3116-s50-sma-b20171107a:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "17AE91E2-ECCB-4077-AE7A-6C202C41E050"}, {"criteria": "cpe:2.3:o:secu:secustation_firmware:2.5.5.3116-s50-sma-b20190723a:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7A5CCD74-43C1-4154-A8AE-6167B3363ED6"}, {"criteria": "cpe:2.3:o:secu:secustation_firmware:2.5.5.3116-s50-smb-b20160601a:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "16515F02-2475-4ED2-9BDD-AB99BCB4062B"}, {"criteria": "cpe:2.3:o:secu:secustation_firmware:2.5.5.3116-s50-smb-b20161012a:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9456605A-DBCE-4825-AA3B-73B37B9D8370"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:secu:secustation:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "63E43C69-8CB3-4C18-808B-6A0865FB11B5"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}

4.9 /10