CVE-2017-15290

HIGH

Mirasys Video Management System 6.x < 6.4.6, 7.x < 7.5.15, 8.x < 8.1.1 - Cleartext Transmission of Sensitive Information

Title source: llm

Description

Mirasys Video Management System (VMS) 6.x before 6.4.6, 7.x before 7.5.15, and 8.x before 8.1.1 has a login process in which cleartext data is sent from a server to a client, and not all of this data is required for the client functionality.

References (2)

Core 2

Core References

Third Party Advisory x_refsource_misc

https://ipvm.com/forums/video-surveillance/topics/mirasys-happy-with-bad-security-unless-hit-with-bad-press

Third Party Advisory x_refsource_misc

https://www.dropbox.com/s/un43q74ie55wtpe/mirasys-vms-leak-2017.zip?dl=1

Scores

CVSS v3 7.5

EPSS 0.0075

EPSS Percentile 50.1%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-319

Status published

Products (10)

mirasys/video_management_system 6.2.5

mirasys/video_management_system 7.0.1

mirasys/video_management_system 7.3.1

mirasys/video_management_system 7.3.3

mirasys/video_management_system 7.5.2

mirasys/video_management_system 7.5.3

mirasys/video_management_system 7.5.7

mirasys/video_management_system 7.5.11

mirasys/video_management_system 8.0.0

mirasys/video_management_system 8.1.0

Published Oct 12, 2017

Tracked Since Feb 18, 2026