CVE-2022-40939 - Vulnerability Details - OpenCVE

In certain Secustation products the administrator account password can be read. This affects V2.5.5.3116-S50-SMA-B20171107A, V2.3.4.1301-M20-TSA-B20150617A, V2.5.5.3116-S50-RXA-B20180502A, V2.5.5.3116-S50-SMA-B20190723A, V2.5.5.3116-S50-SMB-B20161012A, V2.3.4.2103-S50-NTD-B20170508B, V2.5.5.3116-S50-SMB-B20160601A, V2.5.5.2601-S50-TSA-B20151229A, and V2.5.5.3116-S50-SMA-B20170217.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact partial

Vendors	Products
Secu	Secustation Secustation Firmware

Configuration 1 [-]

AND

OR	cpe:2.3:o:secu:secustation_firmware:2.3.4.1301-m20-tsa-b20150617a:::::::*
	cpe:2.3:o:secu:secustation_firmware:2.3.4.2103-s50-ntd-b20170508b:::::::*
	cpe:2.3:o:secu:secustation_firmware:2.5.5.2601-s50-tsa-b20151229a:::::::*
	cpe:2.3:o:secu:secustation_firmware:2.5.5.3116-s50-rxa-b20180502a:::::::*
	cpe:2.3:o:secu:secustation_firmware:2.5.5.3116-s50-sma-b20170217:::::::*
	cpe:2.3:o:secu:secustation_firmware:2.5.5.3116-s50-sma-b20171107a:::::::*
	cpe:2.3:o:secu:secustation_firmware:2.5.5.3116-s50-sma-b20190723a:::::::*
	cpe:2.3:o:secu:secustation_firmware:2.5.5.3116-s50-smb-b20160601a:::::::*
	cpe:2.3:o:secu:secustation_firmware:2.5.5.3116-s50-smb-b20161012a:::::::*

cpe:2.3:h:secu:secustation:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://cdsbz.gitbook.io/untitled/secustion-camera-vulnerability-recurrence

History

Tue, 22 Apr 2025 21:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2022-12-08T00:00:00.000Z

Updated: 2025-04-22T20:28:12.850Z

Reserved: 2022-09-19T00:00:00.000Z

Link: CVE-2022-40939

Vulnrichment

Updated: 2024-08-03T12:28:42.940Z

NVD

Status : Modified

Published: 2022-12-08T17:15:10.493

Modified: 2025-04-22T21:15:43.420

Link: CVE-2022-40939

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-40939", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2025-04-22T20:28:12.850Z", "dateReserved": "2022-09-19T00:00:00.000Z", "datePublished": "2022-12-08T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2022-12-12T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "In certain Secustation products the administrator account password can be read. This affects V2.5.5.3116-S50-SMA-B20171107A, V2.3.4.1301-M20-TSA-B20150617A, V2.5.5.3116-S50-RXA-B20180502A, V2.5.5.3116-S50-SMA-B20190723A, V2.5.5.3116-S50-SMB-B20161012A, V2.3.4.2103-S50-NTD-B20170508B, V2.5.5.3116-S50-SMB-B20160601A, V2.5.5.2601-S50-TSA-B20151229A, and V2.5.5.3116-S50-SMA-B20170217."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://cdsbz.gitbook.io/untitled/secustion-camera-vulnerability-recurrence"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T12:28:42.940Z"}, "title": "CVE Program Container", "references": [{"url": "https://cdsbz.gitbook.io/untitled/secustion-camera-vulnerability-recurrence", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-319", "lang": "en", "description": "CWE-319 Cleartext Transmission of Sensitive Information"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-04-22T20:27:33.592937Z", "id": "CVE-2022-40939", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-22T20:28:12.850Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://cdsbz.gitbook.io/untitled/secustion-camera-vulnerability-recurrence", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T12:28:42.940Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2022-40939", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-22T20:27:33.592937Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-319", "description": "CWE-319 Cleartext Transmission of Sensitive Information"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-22T20:28:07.254Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://cdsbz.gitbook.io/untitled/secustion-camera-vulnerability-recurrence"}], "descriptions": [{"lang": "en", "value": "In certain Secustation products the administrator account password can be read. This affects V2.5.5.3116-S50-SMA-B20171107A, V2.3.4.1301-M20-TSA-B20150617A, V2.5.5.3116-S50-RXA-B20180502A, V2.5.5.3116-S50-SMA-B20190723A, V2.5.5.3116-S50-SMB-B20161012A, V2.3.4.2103-S50-NTD-B20170508B, V2.5.5.3116-S50-SMB-B20160601A, V2.5.5.2601-S50-TSA-B20151229A, and V2.5.5.3116-S50-SMA-B20170217."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2022-12-12T00:00:00.000Z"}}}, "cveMetadata": {"cveId": "CVE-2022-40939", "state": "PUBLISHED", "dateUpdated": "2025-04-22T20:28:12.850Z", "dateReserved": "2022-09-19T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2022-12-08T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:secu:secustation_firmware:2.3.4.1301-m20-tsa-b20150617a:*:*:*:*:*:*:*", "matchCriteriaId": "DA4DECB1-2B10-4693-B1E3-CAD2B12EF8EB", "vulnerable": true}, {"criteria": "cpe:2.3:o:secu:secustation_firmware:2.3.4.2103-s50-ntd-b20170508b:*:*:*:*:*:*:*", "matchCriteriaId": "16387C06-6BED-4717-BB31-5C1F90B88216", "vulnerable": true}, {"criteria": "cpe:2.3:o:secu:secustation_firmware:2.5.5.2601-s50-tsa-b20151229a:*:*:*:*:*:*:*", "matchCriteriaId": "BEDACFB2-E5B5-4A34-8808-57F72D904BA7", "vulnerable": true}, {"criteria": "cpe:2.3:o:secu:secustation_firmware:2.5.5.3116-s50-rxa-b20180502a:*:*:*:*:*:*:*", "matchCriteriaId": "965AA07F-DD63-417A-AE13-C09CCA9EBCD2", "vulnerable": true}, {"criteria": "cpe:2.3:o:secu:secustation_firmware:2.5.5.3116-s50-sma-b20170217:*:*:*:*:*:*:*", "matchCriteriaId": "239F6C71-1D8D-4954-A660-C3DB35455968", "vulnerable": true}, {"criteria": "cpe:2.3:o:secu:secustation_firmware:2.5.5.3116-s50-sma-b20171107a:*:*:*:*:*:*:*", "matchCriteriaId": "17AE91E2-ECCB-4077-AE7A-6C202C41E050", "vulnerable": true}, {"criteria": "cpe:2.3:o:secu:secustation_firmware:2.5.5.3116-s50-sma-b20190723a:*:*:*:*:*:*:*", "matchCriteriaId": "7A5CCD74-43C1-4154-A8AE-6167B3363ED6", "vulnerable": true}, {"criteria": "cpe:2.3:o:secu:secustation_firmware:2.5.5.3116-s50-smb-b20160601a:*:*:*:*:*:*:*", "matchCriteriaId": "16515F02-2475-4ED2-9BDD-AB99BCB4062B", "vulnerable": true}, {"criteria": "cpe:2.3:o:secu:secustation_firmware:2.5.5.3116-s50-smb-b20161012a:*:*:*:*:*:*:*", "matchCriteriaId": "9456605A-DBCE-4825-AA3B-73B37B9D8370", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:secu:secustation:-:*:*:*:*:*:*:*", "matchCriteriaId": "63E43C69-8CB3-4C18-808B-6A0865FB11B5", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In certain Secustation products the administrator account password can be read. This affects V2.5.5.3116-S50-SMA-B20171107A, V2.3.4.1301-M20-TSA-B20150617A, V2.5.5.3116-S50-RXA-B20180502A, V2.5.5.3116-S50-SMA-B20190723A, V2.5.5.3116-S50-SMB-B20161012A, V2.3.4.2103-S50-NTD-B20170508B, V2.5.5.3116-S50-SMB-B20160601A, V2.5.5.2601-S50-TSA-B20151229A, and V2.5.5.3116-S50-SMA-B20170217."}, {"lang": "es", "value": "En determinados productos de Secusation se puede leer la contrase\u00f1a de la cuenta de administrador. Esto afecta a:\nV2.5.5.3116-S50-SMA-B20171107A, \nV2.3.4.1301-M20-TSA-B20150617A, \nV2.5.5.3116-S50-RXA-B20180502A, \nV2.5.5.3116-S50-SMA-B20190723A , \nV2.5.5.3116-S50-SMB-B20161012A, \nV2.3.4.2103-S50-NTD-B20170508B, \nV2.5.5.3116-S50-SMB-B20160601A, \nV2.5.5.2601-S50-TSA-B20151229A y \nV2.5.5.3116-S50-SMA-B20170217."}], "id": "CVE-2022-40939", "lastModified": "2025-04-22T21:15:43.420", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2022-12-08T17:15:10.493", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://cdsbz.gitbook.io/untitled/secustion-camera-vulnerability-recurrence"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://cdsbz.gitbook.io/untitled/secustion-camera-vulnerability-recurrence"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-319"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-319"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}