VULNERABILITY INTELLIGENCE

CVE-2015-2909

CVSS score9.8 CRITICAL

EPSS probability2.94%

CISA KEVNot currently listed

Published2020-02-06

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

Dedicated Micros DV-IP Express, SD Advanced, SD, EcoSense, and DS2 devices rely on a GUI warning to help ensure that the administrator configures login credentials, which makes it easier for remote attackers to obtain access by leveraging situations in which this warning was not heeded. NOTE: the vendor states "The user is presented with clear warnings on the GUI that they should set usernames and passwords."

Weakness classification

CWE-269: Improper Privilege Management

Primary references

cret@cert.org — Exploit, Third Party Advisory
cret@cert.org — Third Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, US Government Resource