CVE Vulnerability

CVE-2020-15785

A vulnerability has been identified in Siveillance Video Client (All versions). In environments where Windows NTLM authentication is enabled the affected client application transmits usernames to the server in cleartext. This could allow an attacker in a privileged network position to obtain valid adminstrator login names and use this information to launch further attacks.

4.3 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8.6 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

Scope

5.3 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://cert-portal.siemens.com/productcert/pdf/ssa-770698.pdf Vendor Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-20-252-05 Third Party Advisory US Government Resource
Configurations

Configuration 1

cpe:2.3:a:siemens:siveillance_video_client:*:*:*:*:*:*:*:*
Information

Published : 2020-09-09 07:15

Updated : 2023-01-27 06:21

NVD link : CVE-2020-15785

Mitre link : CVE-2020-15785

Products Affected
No products.
CWE
CWE-319

Cleartext Transmission of Sensitive Information