VULNERABILITY INTELLIGENCE
CVE-2017-3185
CVSS score9.8 CRITICAL
EPSS probability3.22%
CISA KEVNot currently listed
Published2017-12-16
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
ACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC have a web application that uses the GET method to process requests that contain sensitive information such as user account name and password, which can expose that information through the browser's history, referrers, web logs, and other sources.
Weakness classification
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
- CWE-598: Use of GET Request Method With Sensitive Query Strings
Primary references
- cret@cert.org — Third Party Advisory, VDB Entry
- cret@cert.org — Press/Media Coverage, Third Party Advisory
- cret@cert.org — Press/Media Coverage, Third Party Advisory
- cret@cert.org — Third Party Advisory, US Government Resource
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108 — Press/Media Coverage, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Press/Media Coverage, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, US Government Resource