CVE-2018-16546 - CVE House
Back to Database
Status published Medium CVE-2018-16546

Amcrest networked devices use the same hardcoded SSL private key...

Vulnerability Description

Amcrest networked devices use the same hardcoded SSL private key across different customers' installations, which allows remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of this key from another installation, as demonstrated by Amcrest_IPC-HX1X3X-LEXUS_Eng_N_AMCREST_V2.420.AC01.3.R.20180206.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-16546

Credits & Attribution

No credits recorded in the NVD database.

References

More from amcrest

View All →
CVE-2020-7222
An issue was discovered in Amcrest Web Server 2.520.AC00.18.R 2017-06-29...
Medium 5.3
CVE-2017-8230
On Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices, the users on the device...
High 8.8
CVE-2017-8229
Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices allow an unauthenticated attacker to download...
Critical 9.8
CVE-2017-8228
Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices mishandle reboots within the past two...
High 8.8
CVE-2017-8227
Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices have a timeout policy to wait...
Critical 9.8

Affected Vendor

Affected Software

amcrest ipc-hx1x3x-lexus eng n amcrest
Vulnerable Versions:
v2.420.ac01.3.r.20180206

Timeline

Official Publish: September 5th, 2018
Last Modified: September 16th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.