CVE-2020-9528
CVSS V2 Medium 5
CVSS V3 High 7.5
Description
Firmware developed by Shenzhen Hichip Vision Technology (V6 through V20), as used by many different vendors in millions of Internet of Things devices, suffers from cryptographic issues that allow remote attackers to access user session data, as demonstrated by eavesdropping on user video/audio streams, capturing credentials, and compromising devices. This affects products marketed under the following brand names: Accfly, Alptop, Anlink, Besdersec, BOAVISION, COOAU, CPVAN, Ctronics, D3D Security, Dericam, Elex System, Elite Security, ENSTER, ePGes, Escam, FLOUREON, GENBOLT, Hongjingtian (HJT), ICAMI, Iegeek, Jecurity, Jennov, KKMoon, LEFTEK, Loosafe, Luowice, Nesuniq, Nettoly, ProElite, QZT, Royallite, SDETER, SV3C, SY2L, Tenvis, ThinkValue, TOMLOV, TPTEK, WGCC, and ZILINK.
Overview
- CVE ID
- CVE-2020-9528
- Assigner
- cve@mitre.org
- Vulnerability Status
- Analyzed
- Published Version
- 2020-08-10T16:15:12
- Last Modified Date
- 2020-08-18T13:23:59
Weakness Enumerations
CPE Configuration (Product)
CPE | Vulnerable | Operator | Version Start | Version End |
---|---|---|---|---|
cpe:2.3:o:hichip:shenzhen_hichip_vision_technology_firmware:*:*:*:*:*:*:*:* | 1 | OR | 2020-06-29 |
CVSS Version 2
- Version
- 2.0
- Vector String
- AV:N/AC:L/Au:N/C:P/I:N/A:N
- Access Vector
- NETWORK
- Access Compatibility
- LOW
- Authentication
- NONE
- Confidentiality Impact
- PARTIAL
- Integrity Impact
- NONE
- Availability Impact
- NONE
- Base Score
- 5
- Severity
- MEDIUM
- Exploitability Score
- 10
- Impact Score
- 2.9
CVSS Version 3
- Version
- 3.1
- Vector String
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Attack Vector
- NETWORK
- Attack Compatibility
- LOW
- Privileges Required
- NONE
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality Impact
- HIGH
- Availability Impact
- NONE
- Base Score
- 7.5
- Base Severity
- HIGH
- Exploitability Score
- 3.9
- Impact Score
- 3.6
References
Reference URL | Reference Tags |
---|---|
https://hacked.camera/ | Not Applicable |
https://redprocyon.com | Not Applicable |
Sources
Source Name | Source URL |
---|---|
NIST | https://nvd.nist.gov/vuln/detail/CVE-2020-9528 |
MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9528 |
History
Created | Old Value | New Value | Data Type | Notes |
---|---|---|---|---|
2022-05-10 17:20:25 | Added to TrackCVE | |||
2022-12-04 20:44:33 | 2020-08-10T16:15Z | 2020-08-10T16:15:12 | CVE Published Date | updated |
2022-12-04 20:44:33 | 2020-08-18T13:23:59 | CVE Modified Date | updated | |
2022-12-04 20:44:33 | Analyzed | Vulnerability Status | updated |