Cyber Resilience

CVE-2018-17240

HighPublic PoC

Published: 10 June 2022

Published
10 June 2022
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.4835 97.8th percentile
Risk Priority 44 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2018-17240 is a high-severity Missing Release of Memory after Effective Lifetime (CWE-401) vulnerability in Netwavepr Indoor Ip Camera Firmware. Its CVSS base score is 7.5 (High).

Operationally, ranked in the top 2.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability details

There is a memory dump vulnerability on Netwave IP camera devices at //proc/kcore that allows an unauthenticated attacker to exfiltrate sensitive information from the network configuration (e.g., username and password).

CWE(s)
CWE-401

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

netwavepr
indoor ip camera firmware
all versions
netwavepr
outdoor ip camera firmware
all versions

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References