VulnerabilityModified
CVE-2016-4520
Schneider Electric Pelco Digital Sentry Video Management System with firmware before 7.14 has hardcoded credentials, which allows remote attackers to obtain access, and consequently execute arbitrary code, via unspecified vectors.
CRITICAL 9.8EPSS 5.79%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (5.79%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Schneider Electric Pelco Digital Sentry Video Management System with firmware before 7.14 has hardcoded credentials, which allows remote attackers to obtain access, and consequently execute arbitrary code, via unspecified vectors.
- CVSS 3.0
- 9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 5.79% probability · 93th percentile
- CISA KEV
- Not listed
- Affected
- schneider-electric/pelco digital sentry video management system firmware
- Source
- ics-cert@hq.dhs.gov
References
- http://www.schneider-electric.com/ww/en/download/document/SEVD-2016-153-01Patch, Vendor Advisory
- http://www.securityfocus.com/bid/91783
- https://ics-cert.us-cert.gov/advisories/ICSA-16-196-01Third Party Advisory, US Government Resource
- http://www.schneider-electric.com/ww/en/download/document/SEVD-2016-153-01Patch, Vendor Advisory
- http://www.securityfocus.com/bid/91783
- https://ics-cert.us-cert.gov/advisories/ICSA-16-196-01Third Party Advisory, US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.