CVE-2017-3186

CRITICAL

ACTi D, B, I, and E series cameras >=A1D-500-V6.11.31-AC - Unauthenticated Remote Control via Default Credentials

Title source: llm

Description

ACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC use non-random default credentials across all devices. A remote attacker can take complete control of a device using default admin credentials.

References (4)

Core 4

Core References

Press/Media Coverage x_refsource_misc

https://twitter.com/hack3rsca/status/839599437907386368

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/96720/info

Press/Media Coverage x_refsource_misc

https://twitter.com/Hfuhs/status/839252357221330944

Third Party Advisory, US Government Resource third-party-advisory x_refsource_cert-vn

https://www.kb.cert.org/vuls/id/355151

Scores

CVSS v3 9.8

EPSS 0.0609

EPSS Percentile 92.5%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-521 CWE-798

Status published

Products (2)

acti/camera_firmware a1d-500-v6.11.31-ac

ACTi Corporation/ACTi D, B, I, and E series cameras A1D-500-V6.11.31-AC

Published Dec 16, 2017

Tracked Since Feb 18, 2026