Unencrypted Communication Flaw in XMeye P2P Cloud Server by Hangzhou Xiongmai Technology
CVE-2018-17915

9.8CRITICAL

Key Information:

Vendor

Hangzhou Xiongmai Technology Co., Ltd

Status
Xmeye P2p Cloud Server
Vendor
CVE Published:
10 October 2018

What is CVE-2018-17915?

The XMeye P2P Cloud Server by Hangzhou Xiongmai Technology exhibits a serious communication encryption flaw, as it fails to encrypt all device communications, including those related to the XMeye service and firmware updates. This oversight potentially allows attackers to eavesdrop on live video feeds, capture sensitive login credentials, or execute malicious firmware updates by impersonating the legitimate update server.

Affected Version(s)

XMeye P2P Cloud Server All versions

References

https://ics-cert.us-cert.gov/advisories/ICSA-18-282-06
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.