Details of VAR-201601-0419

ID

VAR-201601-0419

CVE

CVE-2015-8281

TITLE

Samsung SRN-1670D camera contains multiple vulnerabilities

Trust: 0.8

sources: CERT/CC: VU#913000

DESCRIPTION

Web Viewer 1.0.0.193 on Samsung SRN-1670D devices allows attackers to bypass filesystem encryption via XOR calculations. The Samsung SRN-1670D camera contains multiple vulnerabilities. In addition, JVNVU#97593732 Then CWE-327 It is published as CWE-327: Use of a Broken or Risky Cryptographic Algorithm https://cwe.mitre.org/data/definitions/327.htmlBy the attacker, XOR Through calculation, file system encryption may be avoided. SamsungSRN-1670D is a network video recorder product. The SamsungSRN-1670D uses a weak custom encryption algorithm based on a simple XOR operation that allows a remote attacker to exploit this vulnerability to obtain arbitrary files and user credentials. An arbitrary file-read vulnerability 2. An information-disclosure vulnerability 3. A security weakness Successful exploits can allow attackers to read arbitrary files or perform certain unauthorized actions and gain access to potentially sensitive information

Trust: 3.15

sources: NVD: CVE-2015-8281 // CERT/CC: VU#913000 // JVNDB: JVNDB-2015-006816 // CNVD: CNVD-2016-00273 // BID: 80381

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2016-00273

AFFECTED PRODUCTS

vendor:	samsung	model:	web viewer	scope:	lte	version:	1.0.0.193	Trust: 1.0
vendor:	hanwha	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	samsung	model:	web viewer	scope:	eq	version:	0	Trust: 0.8
vendor:	samsung	model:	web viewer	scope:	eq	version:	date created 2013.10.26	Trust: 0.8
vendor:	samsung	model:	web viewer	scope:	eq	version:	version 1	Trust: 0.8
vendor:	samsung	model:	web viewer	scope:	eq	version:	193	Trust: 0.8
vendor:	samsung	model:	srn-1670d	scope:	-	version:	-	Trust: 0.6
vendor:	samsung	model:	web viewer	scope:	eq	version:	1.0.0.193	Trust: 0.6
vendor:	samsung	model:	srn-1670d	scope:	eq	version:	1.0.0.193	Trust: 0.3

sources: CERT/CC: VU#913000 // CNVD: CNVD-2016-00273 // BID: 80381 // JVNDB: JVNDB-2015-006816 // CNNVD: CNNVD-201601-229 // NVD: CVE-2015-8281

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2015-8281
value:	HIGH
Trust: 1.0
NVD:	CVE-2015-8281
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2016-00273
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-201601-229
value:	HIGH
Trust: 0.6

nvd@nist.gov:	CVE-2015-8281
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:L/AU:N/C:C/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2016-00273
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:L/AU:N/C:C/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2015-8281
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.0
Trust: 1.0

sources: CNVD: CNVD-2016-00273 // JVNDB: JVNDB-2015-006816 // CNNVD: CNNVD-201601-229 // NVD: CVE-2015-8281

PROBLEMTYPE DATA

problemtype:

CWE-310

Trust: 1.8

sources: JVNDB: JVNDB-2015-006816 // NVD: CVE-2015-8281

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201601-229

TYPE

encryption problem

Trust: 0.6

sources: CNNVD: CNNVD-201601-229

CONFIGURATIONS

sources: JVNDB: JVNDB-2015-006816

PATCH

title:

SRN-1670D

url:

http://www.samsungsecurity.com/product/product_view.asp?idx=6583

Trust: 0.8

sources: JVNDB: JVNDB-2015-006816

EXTERNAL IDS

db:	CERT/CC	id:	VU#913000	Trust: 4.1
db:	NVD	id:	CVE-2015-8281	Trust: 3.3
db:	JVN	id:	JVNVU97593732	Trust: 0.8
db:	JVNDB	id:	JVNDB-2015-006816	Trust: 0.8
db:	CNVD	id:	CNVD-2016-00273	Trust: 0.6
db:	CNNVD	id:	CNNVD-201601-229	Trust: 0.6
db:	BID	id:	80381	Trust: 0.3

sources: CERT/CC: VU#913000 // CNVD: CNVD-2016-00273 // BID: 80381 // JVNDB: JVNDB-2015-006816 // CNNVD: CNNVD-201601-229 // NVD: CVE-2015-8281

REFERENCES

url:	https://www.kb.cert.org/vuls/id/913000	Trust: 3.3
url:	http://blog.emaze.net/2016/01/multiple-vulnerabilities-samsung-srn.html	Trust: 1.4
url:	about vulnerability notes	Trust: 0.8
url:	contact us about this vulnerability	Trust: 0.8
url:	provide a vendor statement	Trust: 0.8
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-8281	Trust: 0.8
url:	http://jvn.jp/vu/jvnvu97593732/index.html	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-8281	Trust: 0.8
url:	http://www.samsung.com/	Trust: 0.3

sources: CERT/CC: VU#913000 // CNVD: CNVD-2016-00273 // BID: 80381 // JVNDB: JVNDB-2015-006816 // CNNVD: CNNVD-201601-229 // NVD: CVE-2015-8281

CREDITS

Aristide Fattori, Luca Giancane and Roberto Paleari

Trust: 0.3

sources: BID: 80381

SOURCES

db:	CERT/CC	id:	VU#913000
db:	CNVD	id:	CNVD-2016-00273
db:	BID	id:	80381
db:	JVNDB	id:	JVNDB-2015-006816
db:	CNNVD	id:	CNNVD-201601-229
db:	NVD	id:	CVE-2015-8281

LAST UPDATE DATE

2025-04-12T23:14:16.076000+00:00

SOURCES UPDATE DATE

db:	CERT/CC	id:	VU#913000	date:	2016-01-25T00:00:00
db:	CNVD	id:	CNVD-2016-00273	date:	2016-01-19T00:00:00
db:	BID	id:	80381	date:	2016-01-12T00:00:00
db:	JVNDB	id:	JVNDB-2015-006816	date:	2016-01-22T00:00:00
db:	CNNVD	id:	CNNVD-201601-229	date:	2016-01-18T00:00:00
db:	NVD	id:	CVE-2015-8281	date:	2025-04-12T10:46:40.837

SOURCES RELEASE DATE

db:	CERT/CC	id:	VU#913000	date:	2016-01-12T00:00:00
db:	CNVD	id:	CNVD-2016-00273	date:	2016-01-19T00:00:00
db:	BID	id:	80381	date:	2016-01-12T00:00:00
db:	JVNDB	id:	JVNDB-2015-006816	date:	2016-01-22T00:00:00
db:	CNNVD	id:	CNNVD-201601-229	date:	2016-01-14T00:00:00
db:	NVD	id:	CVE-2015-8281	date:	2016-01-15T03:59:12.577