7.5high
CVE-2018-25136
FLIR Brickstream 3D+ 2.1.742.1842 Unauthenticated RTSP Stream Disclosure
Published 10 mo ago · modified 4 mo ago · JSON
CVSS
7.5
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.5%
percentile 44%
Public exploits
0
none known
Summary
FLIR Brickstream 3D+ 2.1.742.1842 contains an unauthenticated vulnerability that allows remote attackers to access live video streams without credentials. Attackers can retrieve video stream images by directly accessing multiple image endpoints like middleImage.jpg, rightimage.jpg, and leftimage.jpg.
CISA SSVC assessment
- Exploitation
- Proof of concept public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 10 mo ago
Exploit prediction (EPSS)
0.51% probability of exploitation in the next 30 days, higher than 44% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected products
- FLIR Systems, Inc. Brickstream 3D+
Classification
- Weakness
- CWE-306 Missing Authentication for Critical Functionality
References
- exploit-db.com /exploits/45607 · exploit
- brickstream.com · product
- zeroscience.mk /en/vulnerabilities/ZSL-2018-5496.php · third-party-advisory, exploit
Sources
- CVE List: CVE-2018-25136
- NVD: CVE-2018-25136
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.