Dedicated Micros DV-IP Express, SD Advanced, SD, EcoSense, and DS2 devices rely on a GUI warning to help ensure that the administrator conf…

published 2020-02-06 6 y ago modified 2026-06-17 4 mo ago also EUVD-2015-2997

cvss: 9.8; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 2.9%; EPSS 2.9% chance of exploitation in 30 days, percentile 87%
public exploits: 0; none known

Dedicated Micros DV-IP Express, SD Advanced, SD, EcoSense, and DS2 devices rely on a GUI warning to help ensure that the administrator configures login credentials, which makes it easier for remote attackers to obtain access by leveraging situations in which this warning was not heeded. NOTE: the vendor states "The user is presented with clear warnings on the GUI that they should set usernames and passwords."

Exploit prediction

2.94% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

cybergibbons.com http://cybergibbons.com/security-2/shodan-searches/interesting-shodan-searches-sd-advanced-dvrs/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	10.0	AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected products

Dedicated Micros DV-IP Express
Dedicated Micros SD Advanced
Dedicated Micros SD
Dedicated Micros EcoSense
Dedicated Micros DS2

Classification

Weakness

CWE-269 Improper Privilege Management

References

cybergibbons.com /security-2/shodan-searches/interesting-shodan-searches-sd-advanced-dvrs/
exploit, third-party-advisory
kb.cert.org /vuls/id/276148
third-party-advisory, us-government-resource

Sources

CVE List CVE-2015-2909
NVD CVE-2015-2909

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary