VulnerabilityModified

CVE-2015-8800

HIGH 7.3EPSS 1.18%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.18%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Symantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5, Embedded Security: Critical System Protection for Controllers and Devices (SES:CSP) 6.5.0 before MP1, Critical System Protection (SCSP) before 5.2.9 MP6, Data Center Security: Server Advanced Server (DCS:SA) 6.x before 6.5 MP1 and 6.6 before MP1, and Data Center Security: Server Advanced Server and Agents (DCS:SA) through 6.6 MP1 allow remote authenticated users to conduct argument-injection attacks by leveraging certain named-pipe access.

CVSS 3.1: 7.3 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H
EPSS: 1.18% probability · 66th percentile
CISA KEV: Not listed
Weakness: CWE-74
Affected: broadcom/symantec critical system protection · broadcom/symantec data center security server · broadcom/symantec data center security server and agents · broadcom/symantec embedded security critical system protection · broadcom/symantec embedded security critical system protection for controllers and devices
Source: secure@symantec.com

References

http://www.securityfocus.com/bid/90886Third Party Advisory, VDB Entry
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160607_00Vendor Advisory
http://www.securityfocus.com/bid/90886Third Party Advisory, VDB Entry
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160607_00Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.