CVE-2018-17919 Hardcoded credentials in XMeye P2P Cloud Server
Attackers can use a hardcoded default account to log in and view video streams on the XMeye P2P Cloud Server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-17919?
CVE-2018-17919 is a medium-severity vulnerability in Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server, published on 10 Oct 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server may allow an attacker to use an undocumented user account "default" with its default password to login to XMeye and access/view video streams.
Which versions are affected by CVE-2018-17919?
It affects 1 product.
Products include Xiongmaitech Xmeye P2p Cloud Server.
How do I fix CVE-2018-17919?
No fix has been published for CVE-2018-17919 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-17919 being exploited?
There is no known exploitation of CVE-2018-17919 in the wild and no public exploit code.
Other vulnerabilities in Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server
Sources
Also known as GHSA-x7pj-758f-q7rv.