CVE-2018-3937
high-risk
Published 2018-08-14
An exploitable command injection vulnerability exists in the measurementBitrateExec functionality of Sony IPELA E Series Network Camera G5 firmware 1.87.00. A specially crafted GET request can cause arbitrary commands to be executed. An attacker can send an HTTP request to trigger this vulnerability.
Do I need to act?
~
3.9% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.1/10
Critical
NETWORK
/ LOW complexity
Affected Products (14)
Snc-Eb600 Firmware
Snc-Eb630 Firmware
Snc-Eb600B Firmware
Snc-Eb630B Firmware
Snc-Eb602R Firmware
Snc-Eb632R Firmware
Snc-Em600 Firmware
Snc-Em601 Firmware
Snc-Em630 Firmware
Snc-Em631 Firmware
Snc-Em602R Firmware
Snc-Em632R Firmware
Snc-Em602Rc Firmware
Snc-Em632Rc Firmware
Affected Vendors
56
/ 100
high-risk
Severity
31/34 · Critical
Exploitability
7/34 · Low
Exposure
18/34 · Moderate