CVE-2018-17915

{"containers": {"cna": {"affected": [{"product": "XMeye P2P Cloud Server", "vendor": "Hangzhou Xiongmai Technology Co., Ltd", "versions": [{"status": "affected", "version": "All versions"}]}], "datePublic": "2018-10-09T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server do not encrypt all device communication. This includes the XMeye service and firmware update communication. This could allow an attacker to eavesdrop on video feeds, steal XMeye login credentials, or impersonate the update server with malicious update code."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-311", "description": "MISSING ENCRYPTION OF SENSITIVE DATA CWE-311", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2018-10-10T14:57:01.000Z", "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-282-06"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "ics-cert@hq.dhs.gov", "DATE_PUBLIC": "2018-10-09T00:00:00", "ID": "CVE-2018-17915", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "XMeye P2P Cloud Server", "version": {"version_data": [{"version_value": "All versions"}]}}]}, "vendor_name": "Hangzhou Xiongmai Technology Co., Ltd"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server do not encrypt all device communication. This includes the XMeye service and firmware update communication. This could allow an attacker to eavesdrop on video feeds, steal XMeye login credentials, or impersonate the update server with malicious update code."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "MISSING ENCRYPTION OF SENSITIVE DATA CWE-311"}]}]}, "references": {"reference_data": [{"name": "https://ics-cert.us-cert.gov/advisories/ICSA-18-282-06", "refsource": "MISC", "url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-282-06"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T11:01:14.678Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-282-06"}]}]}, "cveMetadata": {"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "assignerShortName": "icscert", "cveId": "CVE-2018-17915", "datePublished": "2018-10-10T15:00:00.000Z", "dateReserved": "2018-10-02T00:00:00.000Z", "dateUpdated": "2024-09-16T22:56:29.656Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "XMeye P2P Cloud Server", "vendor": "Hangzhou Xiongmai Technology Co., Ltd", "versions": [{"status": "affected", "version": "All versions"}]}], "source": "ics-cert@hq.dhs.gov"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:xiongmaitech:xmeye_p2p_cloud_server:-:*:*:*:*:*:*:*", "matchCriteriaId": "ADECAB4E-9949-49EC-B3EF-1903CA069822", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server do not encrypt all device communication. This includes the XMeye service and firmware update communication. This could allow an attacker to eavesdrop on video feeds, steal XMeye login credentials, or impersonate the update server with malicious update code."}, {"lang": "es", "value": "Todas las versiones de XMeye P2P Cloud Server, de Hangzhou Xiongmai Technology Co., Ltdm, no cifran todas las comunicaciones del dispositivo. Esto incluye el servicio XMeye y la comunicaci\u00f3n de actualizaciones de firmware. Esto podr\u00eda permitir que un atacante esp\u00ede los feeds de v\u00eddeo, robe credenciales de inicio de sesi\u00f3n de XMeye o suplante el servidor de actualizaci\u00f3n con c\u00f3digo de actualizaci\u00f3n malicioso."}], "id": "CVE-2018-17915", "lastModified": "2026-06-17T01:46:31.450", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 6.4, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-10-10T15:29:00.253", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-282-06"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-282-06"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-311"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-311"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}