VULNERABILITY INTELLIGENCE

CVE-2018-17915

CVSS score9.8 CRITICAL
EPSS probability1.07%
CISA KEVNot currently listed
Published2018-10-10
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server do not encrypt all device communication. This includes the XMeye service and firmware update communication. This could allow an attacker to eavesdrop on video feeds, steal XMeye login credentials, or impersonate the update server with malicious update code.

Weakness classification

  • CWE-311: Missing Encryption of Sensitive Data

Primary references