Samsung Smartviewer vulnerabilities

4 CVEs affecting Samsung Smartviewer, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-11689, published 2018-06-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2014-9265, published 2014-12-08. Medium severity, CVSS 6.8. EPSS: 4% chance of exploitation in the next 30 days. Stack-based buffer overflow in the BackupToAvi method in the CNC_Ctrl ActiveX control in Samsung SmartViewer allows remote attackers to execute arbitrary code via unspecified vectors.
CVE-2015-8039, published 2015-11-02. Medium severity, CVSS 6.8. EPSS: 3.9% chance of exploitation in the next 30 days. Samsung SmartViewer allows remote attackers to execute arbitrary code via unspecified vectors to the (1) DVRSetupSave method in the STWAxConfig control or (2) SendCustomPacket method in the…
CVE-2015-8040, published 2015-11-02. Medium severity, CVSS 6.8. EPSS: 3.4% chance of exploitation in the next 30 days. The rtsp_getdlsendtime method in the CNC_Ctrl control in Samsung SmartViewer allows remote attackers to execute arbitrary code via an index value.
CVE-2018-11689, published 2018-06-14. Medium severity, CVSS 6.1. EPSS: 1.6% chance of exploitation in the next 30 days. Web Viewer for Hanwha DVR 2.17 and Smart Viewer in Samsung Web Viewer for Samsung DVR are vulnerable to XSS via the /cgi-bin/webviewer_login_page data3 parameter. (The same Web Viewer codebase was…