CWE Code: 200
Vulnerability Type: privilege_escalation
CVSS Score: 4.0
CWE Name:  Information Exposure
Summary: a password in configuration file issue was discovered in hikvision ds-2cd2xx2f-i series v5.2.0 build 140721 to v5.4.0 build 160530, ds-2cd2xx0f-i series v5.2.0 build 140721 to v5.4.0 build 160401, ds-2cd2xx2fwd series v5.3.1 build 150410 to v5.4.4 build 161125, ds-2cd4x2xfwd series v5.2.0 build 140721 to v5.4.0 build 160414, ds-2cd4xx5 series v5.2.0 build 140721 to v5.4.0 build 160421, ds-2dfx series v5.2.0 build 140805 to v5.4.5 build 160928, and ds-2cd63xx series v5.0.9 build 140305 to v5.3.5 build 160106 devices. the password in configuration file vulnerability could allow a malicious user to escalate privileges or assume the identity of another user and access sensitive information.
Access Authentication: SINGLE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/NONE/NONE
Published Date: 2017-05-06
Last Modified Date: 2017-12-19