CVE-2017-14262

On Samsung NVR devices, remote attackers can read the MD5 password hash of the 'admin' account via certain szUserName JSON data to cgi-bin/main-cgi, and login to the device with that hash in the szUserPasswd parameter.

Score

CVSS 3.0 8.1 High

Status

Modified - cve@mitre.org

Published

2017-09-11

Last modified

2024-08-05

Weaknesses

CWE-326

Affected products

• Srn 1000 Firmware (Samsung)
• Srn 1670d Firmware (Samsung)
• Srn 470d Firmware (Samsung)
• Srn 472s Firmware (Samsung)

References

• https://github.com/zzz66686/Samsung_NVR_vul