CVE-2017-15290

Mirasys Video Management System (VMS) 6.x before 6.4.6, 7.x before 7.5.15, and 8.x before 8.1.1 has a login process in which cleartext data is sent from a server to a client, and not all of this data is required for the client functionality.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 35%
VendorProductVersion
mirasysvideo_management_system
6.2.5
mirasysvideo_management_system
7.0.1
mirasysvideo_management_system
7.3.1
mirasysvideo_management_system
7.3.3
mirasysvideo_management_system
7.5.2
mirasysvideo_management_system
7.5.3
mirasysvideo_management_system
7.5.7
mirasysvideo_management_system
7.5.11
mirasysvideo_management_system
8.0.0
mirasysvideo_management_system
8.1.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://ipvm.com/forums/video-surveillance/topics/mirasys-happy-with-bad-security-unless-hit-with-bad-press
https://www.dropbox.com/s/un43q74ie55wtpe/mirasys-vms-leak-2017.zip?dl=1
https://ipvm.com/forums/video-surveillance/topics/mirasys-happy-with-bad-security-unless-hit-with-bad-press
https://www.dropbox.com/s/un43q74ie55wtpe/mirasys-vms-leak-2017.zip?dl=1