SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2015-2909

Dedicated Micros DV-IP Express, SD Advanced, SD, EcoSense, and DS2 devices rely on a GUI warning to help ensure that the administrator configures login credentials, which makes it easier for remote attackers to obtain access by leveraging situations in…

CRITICAL 9.8EPSS 2.94%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (2.94%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Dedicated Micros DV-IP Express, SD Advanced, SD, EcoSense, and DS2 devices rely on a GUI warning to help ensure that the administrator configures login credentials, which makes it easier for remote attackers to obtain access by leveraging situations in which this warning was not heeded. NOTE: the vendor states "The user is presented with clear warnings on the GUI that they should set usernames and passwords."

CVSS 3.1
9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
2.94% probability · 86th percentile
CISA KEV
Not listed
Weakness
CWE-269
Affected
netvu/dv-ip express firmware · netvu/sd-advanced - sdhd firmware · netvu/sd-advanced 8\/12\/16 vga firmware · netvu/sd advanced closed iptv \(m3u\) firmware · netvu/sd advanced non closed iptv \(m3u\) firmware · netvu/sd advanced nvr firmware · netvu/sd 32 \(m3g\) firmware · netvu/sd 32 \(m3h\) firmware · netvu/sd 4 \(m3s\) firmware · netvu/sd 4 \(m3t\) firmware · netvu/sd 8\/12\/16 no kbd \(m3r\) firmware · netvu/sd 8\/12\/16 no kbd \(m3s\) firmware · netvu/sd 8\/16 front panel kbd \(m3r\) firmware · netvu/sd 8\/16 front panel kbd \(m3u\) firmware · netvu/ecosense 4\/8\/16 \(m4t\) firmware · netvu/ds2 \(dvtr\) firmware · netvu/ds2 \(dvtu\) firmware · netvu/ds2 \(dvtx\) firmware · netvu/ds2 \(dvtx\) netvu connected firmware · netvu/ds2 \(m2ip\) firmware
Source
cret@cert.org

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.