CVE-2015-2909

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-02-06 · updated 2026-06-17
Weakness: CWE-269

Description

Dedicated Micros DV-IP Express, SD Advanced, SD, EcoSense, and DS2 devices rely on a GUI warning to help ensure that the administrator configures login credentials, which makes it easier for remote attackers to obtain access by leveraging situations in which this warning was not heeded. NOTE: the vendor states "The user is presented with clear warnings on the GUI that they should set usernames and passwords."

Affected products

Netvu Ds2 (Dvtr) Firmware: all versions
Netvu Ds2 (Dvtu) Firmware: all versions
Netvu Ds2 (Dvtx) Firmware: all versions
Netvu Ds2 (Dvtx) Netvu Connected Firmware: all versions
Netvu Ds2 (M2Ip) Firmware: all versions
Netvu Dv-Ip Express Firmware: all versions
Netvu Ecosense 4/8/16 (M4T) Firmware: all versions
Netvu Sd-Advanced - Sdhd Firmware: all versions
Netvu Sd-Advanced 8/12/16 Vga Firmware: all versions
Netvu Sd 32 (M3G) Firmware: all versions
Netvu Sd 32 (M3H) Firmware: all versions
Netvu Sd 4 (M3S) Firmware: all versions
Netvu Sd 4 (M3T) Firmware: all versions
Netvu Sd 8/12/16 No Kbd (M3R) Firmware: all versions
Netvu Sd 8/12/16 No Kbd (M3S) Firmware: all versions
Netvu Sd 8/16 Front Panel Kbd (M3R) Firmware: all versions
Netvu Sd 8/16 Front Panel Kbd (M3U) Firmware: all versions
Netvu Sd Advanced Closed Iptv (M3U) Firmware: all versions
Netvu Sd Advanced Non Closed Iptv (M3U) Firmware: all versions
Netvu Sd Advanced Nvr Firmware: all versions

References

Get alerted when CVE-2015-2909 or the next vulnerability affects your stack