CVE-2018-10328 — HIGH (7.4)

Vulnerability Description

Momentum Axel 720P 5.1.8 devices have a hardcoded password of streaming for the appagent account, which allows remote attackers to view the RTSP video stream.

CVSS Score

7.4

HIGH

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Momentum	Momentum Axel 720P Firmware	5.1.8
Momentum	Momentum Axel 720P	-

Related Weaknesses (CWE)

CWE-798

References

https://rchase.com/downloads/momentum-iot-penetration-test-report.pdfThird Party Advisory
https://rchase.com/downloads/momentum-iot-penetration-test-report.pdfThird Party Advisory

FAQ

What is CVE-2018-10328?

CVE-2018-10328 is a vulnerability with a CVSS score of 7.4 (HIGH). Momentum Axel 720P 5.1.8 devices have a hardcoded password of streaming for the appagent account, which allows remote attackers to view the RTSP video stream.

How severe is CVE-2018-10328?

CVE-2018-10328 has been rated HIGH with a CVSS base score of 7.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2018-10328?

Check the references section above for vendor advisories and patch information. Affected products include: Momentum Momentum Axel 720P Firmware, Momentum Momentum Axel 720P.