Undocumented User Account Vulnerability in Hangzhou Xiongmai Technology's XMeye P2P Cloud Server
CVE-2018-17919

6.5MEDIUM

Key Information:

Vendor

Hangzhou Xiongmai Technology Co., Ltd

Status
Xmeye P2p Cloud Server
Vendor
CVE Published:
10 October 2018

What is CVE-2018-17919?

The XMeye P2P Cloud Server, developed by Hangzhou Xiongmai Technology Co., Ltd, is susceptible to an authentication bypass vulnerability. This issue arises from the presence of an undocumented user account 'default' that, combined with a default password, allows unauthorized access to the server. An attacker could potentially exploit this vulnerability to gain access to sensitive video streams, posing a significant risk to user privacy and system integrity. Ensuring that default credentials are updated and not left in place is critical for securing this platform.

Affected Version(s)

XMeye P2P Cloud Server All versions

References

https://ics-cert.us-cert.gov/advisories/ICSA-18-282-06
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.