CVE-2013-3431
Cisco Video Surveillance Manager (VSM) before 7.0.0 does not require authentication for access to VSMC monitoring pages, which allows remote attackers to obtain sensitive configuration, archive, and log information via unspecified vectors, related to…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (9.26%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Cisco Video Surveillance Manager (VSM) before 7.0.0 does not require authentication for access to VSMC monitoring pages, which allows remote attackers to obtain sensitive configuration, archive, and log information via unspecified vectors, related to the Cisco_VSBWT (aka Broadware sample code) package, aka Bug ID CSCsv40169.
- CVSS 2.0
- 7.8 HIGHAV:N/AC:L/Au:N/C:C/I:N/A:N
- EPSS
- 9.26% probability · 95th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-287
- Affected
- cisco/video surveillance manager
- Source
- psirt@cisco.com
References
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130724-vsmVendor Advisory
- http://www.securityfocus.com/bid/61431
- http://www.securitytracker.com/id/1028827
- https://exchange.xforce.ibmcloud.com/vulnerabilities/85945
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130724-vsmVendor Advisory
- http://www.securityfocus.com/bid/61431
- http://www.securitytracker.com/id/1028827
- https://exchange.xforce.ibmcloud.com/vulnerabilities/85945
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.