« Volver al listado

CVE-2016-2359

Estado: ModificadaCrítica (9.8)—

Milesight IP security cameras through 2016-11-14 allow remote attackers to bypass authentication and access a protected resource by simultaneously making a request for the unprotected vb.htm resource.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Milesight — IP Security Camera Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2016-2359",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cret@cert.org",
      "affectedData": [
        {
          "vendor": "Milesight",
          "product": "IP security cameras",
          "versions": [
            {
              "status": "affected",
              "version": "through 2016-11-14"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-10-25T15:15:11.730",
  "references": [
    {
      "url": "http://kirils.org/slides/2016-10-06_Milesight_initial.pdf",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "https://possiblesecurity.com/news/vulnerabilities-of-milesight-ip-security-cameras/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "https://www.youtube.com/watch?v=scckkI7CAW0",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://kirils.org/slides/2016-10-06_Milesight_initial.pdf",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://possiblesecurity.com/news/vulnerabilities-of-milesight-ip-security-cameras/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.youtube.com/watch?v=scckkI7CAW0",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Milesight IP security cameras through 2016-11-14 allow remote attackers to bypass authentication and access a protected resource by simultaneously making a request for the unprotected vb.htm resource."
    },
    {
      "lang": "es",
      "value": "Las cámaras de seguridad IP de Milesight hasta el 14-11-2016, permiten a atacantes remotos omitir la autenticación y acceder a un recurso protegido al realizar simultáneamente una petición para el recurso vb.htm desprotegido."
    }
  ],
  "lastModified": "2026-06-17T00:43:53.050",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:milesight:ip_security_camera_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EF25BFA1-8B83-4C50-AEF4-9EE9B0BDB465",
              "versionEndIncluding": "2016-11-14"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:milesight:ip_security_camera:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "36BE725B-4DC3-47C7-BEB1-D174825B7645"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cret@cert.org"
}