Sign-up

ID

VAR-201707-0080


CVE

CVE-2015-2279


TITLE

plural AirLive In product firmware OS Command injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2015-007668

DESCRIPTION

cgi_test.cgi in AirLive BU-2015 with firmware 1.03.18, BU-3026 with firmware 1.43, and MD-3025 with firmware 1.81 allows remote attackers to execute arbitrary OS commands via shell metacharacters after an "&" (ampersand) in the write_mac write_pid, write_msn, write_tan, or write_hdv parameter. AirLive BU-2015 , BU-3026 , MD-3025 The firmware of OS A command injection vulnerability exists.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Airlive is an IP surveillance network solution provider and security product vendor. An attacker could use this vulnerability to inject arbitrary commands by sending a constructed request to the file. Multiple AirLive Products are prone to multiple OS command-injection vulnerabilities. OvisLink AirLive IP Cameras MD-3025, IP Cameras BU-3026 and IP Cameras BU-2015 are network camera products of OvisLink. The following products are affected: OvisLink AirLive IP Cameras MD-3025 with firmware version 1.81, IP Cameras BU-3026 with firmware version 1.43, IP Cameras BU-2015 with firmware version 1.03.18

Trust: 2.61

sources: NVD: CVE-2015-2279 // JVNDB: JVNDB-2015-007668 // CNVD: CNVD-2015-04575 // BID: 75559 // VULHUB: VHN-80240 // VULMON: CVE-2015-2279

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2015-04575

AFFECTED PRODUCTS

vendor:airlivemodel:bu-3026scope:eqversion:1.43

Trust: 1.6

vendor:airlivemodel:bu-2015scope:eqversion:1.03.18

Trust: 1.6

vendor:airlivemodel:md-3025scope:eqversion:1.81

Trust: 1.6

vendor:ovislink corpmodel:airlive bu-2015scope: - version: -

Trust: 0.8

vendor:ovislink corpmodel:airlive bu-3026scope: - version: -

Trust: 0.8

vendor:ovislink corpmodel:airlive md-3025scope: - version: -

Trust: 0.8

vendor:airlivemodel:md-3025/bu-3026/bu-2015scope: - version: -

Trust: 0.6

vendor:airlivemodel:wl-2000cam lm.1.6.18.14.10.2011scope: - version: -

Trust: 0.3

vendor:airlivemodel:poe-200cam lm.1.6.17.01scope:eqversion:v2

Trust: 0.3

vendor:airlivemodel:md-3025scope:eqversion:1.81.21.08.2014

Trust: 0.3

vendor:airlivemodel:bu-3026scope:eqversion:1.43.21.08.2014

Trust: 0.3

vendor:airlivemodel:bu-2015scope:eqversion:1.03.18.16.06.2014

Trust: 0.3

sources: CNVD: CNVD-2015-04575 // BID: 75559 // JVNDB: JVNDB-2015-007668 // CNNVD: CNNVD-201507-355 // NVD: CVE-2015-2279

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2015-2279
value: CRITICAL

Trust: 1.0

NVD: CVE-2015-2279
value: CRITICAL

Trust: 0.8

CNVD: CNVD-2015-04575
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201507-355
value: CRITICAL

Trust: 0.6

VULHUB: VHN-80240
value: HIGH

Trust: 0.1

VULMON: CVE-2015-2279
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2015-2279
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2015-04575
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-80240
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2015-2279
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: CNVD: CNVD-2015-04575 // VULHUB: VHN-80240 // VULMON: CVE-2015-2279 // JVNDB: JVNDB-2015-007668 // CNNVD: CNNVD-201507-355 // NVD: CVE-2015-2279

PROBLEMTYPE DATA

problemtype:CWE-78

Trust: 1.9

sources: VULHUB: VHN-80240 // JVNDB: JVNDB-2015-007668 // NVD: CVE-2015-2279

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201507-355

TYPE

operating system commend injection

Trust: 0.6

sources: CNNVD: CNNVD-201507-355

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2015-007668

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-80240 // 
            
            
            
            VULMON: CVE-2015-2279

PATCH
title:Top Pageurl:http://www.airlive.com/
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2015-007668

EXTERNAL IDS
db:NVDid:CVE-2015-2279
Trust: 3.5
db:BIDid:75559
Trust: 2.1
db:EXPLOIT-DBid:37532
Trust: 1.8
db:PACKETSTORMid:132585
Trust: 1.8
db:JVNDBid:JVNDB-2015-007668
Trust: 0.8
db:CNNVDid:CNNVD-201507-355
Trust: 0.7
db:CNVDid:CNVD-2015-04575
Trust: 0.6
db:VULHUBid:VHN-80240
Trust: 0.1
db:VULMONid:CVE-2015-2279
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2015-04575 // 
            
            
            
            VULHUB: VHN-80240 // 
            
            
            
            VULMON: CVE-2015-2279 // 
            
            
            
            BID: 75559 // 
            
            
            
            JVNDB: JVNDB-2015-007668 // 
            
            
            
            CNNVD: CNNVD-201507-355 // 
            
            
            
            NVD: CVE-2015-2279

REFERENCES
url:https://www.coresecurity.com/advisories/airlive-multiple-products-os-command-injection
Trust: 2.9
url:http://www.securityfocus.com/bid/75559
Trust: 1.9
url:https://www.exploit-db.com/exploits/37532/
Trust: 1.9
url:http://seclists.org/fulldisclosure/2015/jul/29
Trust: 1.8
url:http://packetstormsecurity.com/files/132585/airlive-remote-command-injection.html
Trust: 1.8
url:http://www.securityfocus.com/archive/1/535938/100/0/threaded
Trust: 1.2
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-2279
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2015-2279
Trust: 0.8
url:https://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-2279
Trust: 0.6
url:http://www.securityfocus.com/archive/1/535938
Trust: 0.6
url:http://www.securityfocus.com/archive/1/archive/1/535938/100/0/threaded
Trust: 0.6
url:http://www.airlive.com/
Trust: 0.3
url:https://cwe.mitre.org/data/definitions/78.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2015-04575 // 
            
            
            
            VULHUB: VHN-80240 // 
            
            
            
            VULMON: CVE-2015-2279 // 
            
            
            
            BID: 75559 // 
            
            
            
            JVNDB: JVNDB-2015-007668 // 
            
            
            
            CNNVD: CNNVD-201507-355 // 
            
            
            
            NVD: CVE-2015-2279

CREDITS
Nahuel Riva from Core Security Exploit Writing Team
Trust: 0.9
sources:
            
            
            BID: 75559 // 
            
            
            
            CNNVD: CNNVD-201507-355

SOURCES
db:CNVDid:CNVD-2015-04575
db:VULHUBid:VHN-80240
db:VULMONid:CVE-2015-2279
db:BIDid:75559
db:JVNDBid:JVNDB-2015-007668
db:CNNVDid:CNNVD-201507-355
db:NVDid:CVE-2015-2279

LAST UPDATE DATE
2025-04-20T23:22:07.837000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2015-04575date:2015-07-16T00:00:00
db:VULHUBid:VHN-80240date:2018-10-09T00:00:00
db:VULMONid:CVE-2015-2279date:2018-10-09T00:00:00
db:BIDid:75559date:2015-07-06T00:00:00
db:JVNDBid:JVNDB-2015-007668date:2017-08-28T00:00:00
db:CNNVDid:CNNVD-201507-355date:2017-07-25T00:00:00
db:NVDid:CVE-2015-2279date:2025-04-20T01:37:25.860

SOURCES RELEASE DATE
db:CNVDid:CNVD-2015-04575date:2015-07-16T00:00:00
db:VULHUBid:VHN-80240date:2017-07-25T00:00:00
db:VULMONid:CVE-2015-2279date:2017-07-25T00:00:00
db:BIDid:75559date:2015-07-06T00:00:00
db:JVNDBid:JVNDB-2015-007668date:2017-08-28T00:00:00
db:CNNVDid:CNNVD-201507-355date:2015-07-13T00:00:00
db:NVDid:CVE-2015-2279date:2017-07-25T01:29:00.420