CVE-2017-3185

State: Published
Severity: Not scored
Published: Dec 15, 2017
Updated: Aug 5, 2024
Reserved: Dec 5, 2016

Description

ACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC have a web application that uses the GET method to process requests that contain sensitive information such as user account name and password, which can expose that information through the browser's history, referrers, web logs, and other sources.

Scores

The record has no CVSS score.

Weaknesses

CWE-598 Information Exposure Through Query Strings in GET Request

Affected Products

Product	Versions
ACTi D, B, I, and E series camerasACTi Corporation	A1D-500-V6.11.31-ACAffected

References

https://twitter.com/hack3rsca/status/839599437907386368
96720vdb-entry
https://twitter.com/Hfuhs/status/839252357221330944
VU#355151third-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.