fkie_cve-2019-6698
Vulnerability from fkie_nvd
Published
2019-08-23 20:15
Modified
2024-11-21 04:46
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
Use of Hard-coded Credentials vulnerability in FortiRecorder all versions below 2.7.4 may allow an unauthenticated attacker with knowledge of the aforementioned credentials and network access to FortiCameras to take control of those, provided they are managed by a FortiRecorder device.
References
psirt@fortinet.comhttps://fortiguard.com/advisory/FG-IR-19-185Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://fortiguard.com/advisory/FG-IR-19-185Vendor Advisory
Impacted products
Vendor Product Version
fortinet fortirecorder_firmware *
fortinet fortirecorder_100d -
fortinet fortirecorder_200d -
fortinet fortirecorder_400d -


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:fortinet:fortirecorder_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2D383C63-3EE9-4285-8234-CD9ABDEDCFB4",
              "versionEndExcluding": "2.7.4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:fortinet:fortirecorder_100d:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A46FAC06-A480-4DA2-94CA-F62E375FE852",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:fortinet:fortirecorder_200d:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "22C395A3-045D-49A1-8388-7279BB812F50",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:fortinet:fortirecorder_400d:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A83F3798-7188-498A-95A7-FF4FB3EEC63A",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Use of Hard-coded Credentials vulnerability in FortiRecorder all versions below 2.7.4 may allow an unauthenticated attacker with knowledge of the aforementioned credentials and network access to FortiCameras to take control of those, provided they are managed by a FortiRecorder device."
    },
    {
      "lang": "es",
      "value": "El uso de la vulnerabilidad de Credenciales codificadas en FortiRecorder en todas las versiones anteriores a 2.7.4 puede permitir que un atacante no autenticado con conocimiento de las credenciales mencionadas y el acceso a la red de FortiCameras tome el control de ellas, siempre que est\u00e9n administradas por un dispositivo FortiRecorder."
    }
  ],
  "id": "CVE-2019-6698",
  "lastModified": "2024-11-21T04:46:58.520",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2019-08-23T20:15:10.427",
  "references": [
    {
      "source": "psirt@fortinet.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://fortiguard.com/advisory/FG-IR-19-185"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://fortiguard.com/advisory/FG-IR-19-185"
    }
  ],
  "sourceIdentifier": "psirt@fortinet.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-798"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.