Samsung Smart Viewer vulnerabilities

3 CVEs affecting Samsung Smart Viewer, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2014-9266, published 2014-12-08.

More from Samsung.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2013-3585, published 2013-08-28. Medium severity, CVSS 5.0. EPSS: 23.5% chance of exploitation in the next 30 days. Samsung Web Viewer for Samsung DVR devices stores credentials in cleartext, which allows context-dependent attackers to obtain sensitive information via vectors involving (1) direct access to a file…
• CVE-2013-3586, published 2013-08-28. High severity, CVSS 7.6. EPSS: 11.2% chance of exploitation in the next 30 days. Samsung Web Viewer for Samsung DVR devices allows remote attackers to bypass authentication via an arbitrary SessionID value in a cookie.
• CVE-2014-9266, published 2014-12-08. Medium severity, CVSS 6.8. EPSS: 2.6% chance of exploitation in the next 30 days. The STWConfig ActiveX control in Samsung SmartViewer does not properly initialize a variable, which allows remote attackers to execute arbitrary code via unspecified vectors.