CVE-2018-11689 : Web Viewer for Hanwha DVR 2.17 and Smart Viewer in Samsung Web Viewer for Samsun

Web Viewer for Hanwha DVR 2.17 and Smart Viewer in Samsung Web Viewer for Samsung DVR are vulnerable to XSS via the /cgi-bin/webviewer_login_page data3 parameter. (The same Web Viewer codebase was transitioned from Samsung to Hanwha.)

Published 2018-06-14 20:29:00

Updated 2022-04-24 01:54:58

Source MITRE

View at NVD, CVE.org

Vulnerability category: Cross site scripting (XSS)

Products affected by CVE-2018-11689

Samsung » Smartviewer » Version: N/A
cpe:2.3:a:samsung:smartviewer:-:*:*:*:*:*:*:*
Matching versions
Hanwha-security » Hrd-1642 Firmware
Versions up to, including, (<=) 1.16
cpe:2.3:o:hanwha-security:hrd-1642_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Hanwha-security » Hrd-1642 » Version: N/A
Hanwha-security » Hrd-842 Firmware
Versions up to, including, (<=) 1.16
cpe:2.3:o:hanwha-security:hrd-842_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Hanwha-security » Hrd-842 » Version: N/A
Hanwha-security » Hrd-442 Firmware
Versions up to, including, (<=) 1.16
cpe:2.3:o:hanwha-security:hrd-442_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Hanwha-security » Hrd-442 » Version: N/A
Hanwha-security » Hrd-1641 Firmware
Versions up to, including, (<=) 1.14
cpe:2.3:o:hanwha-security:hrd-1641_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Hanwha-security » Hrd-1641 » Version: N/A
Hanwha-security » Hrd-841 Firmware
Versions up to, including, (<=) 1.14
cpe:2.3:o:hanwha-security:hrd-841_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Hanwha-security » Hrd-841 » Version: N/A
Hanwha-security » Hrd-840 Firmware
Versions up to, including, (<=) 1.14
cpe:2.3:o:hanwha-security:hrd-840_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Hanwha-security » Hrd-840 » Version: N/A
Hanwha-security » Hrd-440 Firmware
Versions up to, including, (<=) 1.14
cpe:2.3:o:hanwha-security:hrd-440_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Hanwha-security » Hrd-440 » Version: N/A
Hanwha-security » Hrd-443 Firmware
Versions up to, including, (<=) 1.14
cpe:2.3:o:hanwha-security:hrd-443_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Hanwha-security » Hrd-443 » Version: N/A
Hanwha-security » Srd-1694u Firmware
Versions up to, including, (<=) 1.14
cpe:2.3:o:hanwha-security:srd-1694u_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Hanwha-security » Srd-1694u » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2018-11689

EPSS FAQ

9.48%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 94 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-11689

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	2.8	2.7	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Changed Confidentiality: Low Integrity: Low Availability: None

CWE ids for CVE-2018-11689

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2018-11689

https://seclists.org/bugtraq/2018/Jun/40

Bugtraq: Samsung Web Viewer for Samsung DVR Reflected Cross Site Scripting (XSS) CVE-2018-11689
Exploit;Mailing List;Third Party Advisory
http://www.securityfocus.com/archive/1/542083/100/0/threaded

SecurityFocus
Exploit;Third Party Advisory;URL Repurposed;VDB Entry
https://drive.google.com/file/d/1aWbvdrx1KRkUv4ikkm530a2N5qrxCLmr/view?usp=sharing

https://drive.google.com/file/d/1aWbvdrx1KRkUv4ikkm530a2N5qrxCLmr/view?usp=sharing
Exploit;Third Party Advisory
https://vulmon.com/vulnerabilitydetails?qid=CVE-2018-11689

CVE-2018-11689 Smart Viewer in Samsung Web Viewer for Samsung...
Third Party Advisory

Jump to

Vulnerability Details : CVE-2018-11689

Products affected by CVE-2018-11689

Exploit prediction scoring system (EPSS) score for CVE-2018-11689

CVSS scores for CVE-2018-11689

CWE ids for CVE-2018-11689

References for CVE-2018-11689