CVE-2017-3185

Critical

Published: 16/12/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

ACTi cameras, including the D, B, I, and E series, using firmware version A1D-500-V6.11.31-AC have a web application that uses the GET method to process requests containing sensitive information such as user account name and password.

Risk Assessment

Using the GET method to transmit sensitive data may lead to its exposure through browser history, referrers, web logs, and other sources, posing a risk of user data theft.

Recommendation

It is recommended to update the camera firmware to the latest version and change the methods of transmitting sensitive information to more secure ones, such as POST.

Original NVD description (English source)

ACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC have a web application that uses the GET method to process requests that contain sensitive information such as user account name and password, which can expose that information through the browser's history, referrers, web logs, and other sources.