Details of VAR-201904-1127

ID

VAR-201904-1127

CVE

CVE-2019-10710

TITLE

Hisilicon Hi3510 Permission vulnerability in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2019-004338

DESCRIPTION

Insecure permissions in the Web management portal on all IP cameras based on Hisilicon Hi3510 firmware allow authenticated attackers to receive a network's cleartext WiFi credentials via a specific HTTP request. This affects certain devices labeled as HI3510, HI3518, LOOSAFE, LEVCOECAM, Sywstoda, BESDER, WUSONGLUSAN, GADINAN, Unitoptek, ESCAM, etc. Hisilicon Hi3510 There is a permission vulnerability in the firmware.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Hisilicon Hi3510 is a firmware used by an IP camera of Hisilicon in China. There is a security vulnerability in the web management portal in the Hisilicon Hi3510 firmware. Attackers can use HTTP requests to exploit this vulnerability to obtain network WiFi passwords in clear text. The following manufacturers are affected: LOOSAFE; LEVCOECAM; Sywstoda; BESDER; WUSONGLUSAN; GADINAN;

Trust: 1.71

sources: NVD: CVE-2019-10710 // JVNDB: JVNDB-2019-004338 // VULHUB: VHN-142284

AFFECTED PRODUCTS

vendor:	hisilicon	model:	hi3510	scope:	eq	version:	-	Trust: 1.0
vendor:	hisilicon	model:	hi3510	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2019-004338 // NVD: CVE-2019-10710

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-10710
value:	HIGH
Trust: 1.0
NVD:	CVE-2019-10710
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-201904-1069
value:	HIGH
Trust: 0.6
VULHUB:	VHN-142284
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2019-10710
severity:	MEDIUM
baseScore:	4.0
vectorString:	AV:N/AC:L/AU:S/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	8.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-142284
severity:	MEDIUM
baseScore:	4.0
vectorString:	AV:N/AC:L/AU:S/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	8.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2019-10710
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	5.9
version:	3.0
Trust: 1.8

sources: VULHUB: VHN-142284 // JVNDB: JVNDB-2019-004338 // CNNVD: CNNVD-201904-1069 // NVD: CVE-2019-10710

PROBLEMTYPE DATA

problemtype:	CWE-732	Trust: 1.1
problemtype:	CWE-275	Trust: 0.9

sources: VULHUB: VHN-142284 // JVNDB: JVNDB-2019-004338 // NVD: CVE-2019-10710

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201904-1069

TYPE

authorization issue

Trust: 0.6

sources: CNNVD: CNNVD-201904-1069

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-004338

PATCH

title:

Top Page

url:

http://www.hisilicon.com/

Trust: 0.8

sources: JVNDB: JVNDB-2019-004338

EXTERNAL IDS

db:	NVD	id:	CVE-2019-10710	Trust: 2.5
db:	JVNDB	id:	JVNDB-2019-004338	Trust: 0.8
db:	CNNVD	id:	CNNVD-201904-1069	Trust: 0.7
db:	VULHUB	id:	VHN-142284	Trust: 0.1

sources: VULHUB: VHN-142284 // JVNDB: JVNDB-2019-004338 // CNNVD: CNNVD-201904-1069 // NVD: CVE-2019-10710

REFERENCES

url:	https://dojo.bullguard.com/dojo-by-bullguard/blog/cam-hi-risk/	Trust: 2.5
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-10710	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2019-10710	Trust: 0.8

sources: VULHUB: VHN-142284 // JVNDB: JVNDB-2019-004338 // CNNVD: CNNVD-201904-1069 // NVD: CVE-2019-10710

SOURCES

db:	VULHUB	id:	VHN-142284
db:	JVNDB	id:	JVNDB-2019-004338
db:	CNNVD	id:	CNNVD-201904-1069
db:	NVD	id:	CVE-2019-10710

LAST UPDATE DATE

2024-11-23T21:59:59.432000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-142284	date:	2020-08-24T00:00:00
db:	JVNDB	id:	JVNDB-2019-004338	date:	2019-05-30T00:00:00
db:	CNNVD	id:	CNNVD-201904-1069	date:	2020-08-25T00:00:00
db:	NVD	id:	CVE-2019-10710	date:	2024-11-21T04:19:47.023

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-142284	date:	2019-04-23T00:00:00
db:	JVNDB	id:	JVNDB-2019-004338	date:	2019-05-30T00:00:00
db:	CNNVD	id:	CNNVD-201904-1069	date:	2019-04-23T00:00:00
db:	NVD	id:	CVE-2019-10710	date:	2019-04-23T20:32:43.023