CVE-2019-6973 in the critical feed json
Sricam IP CCTV cameras are vulnerable to denial of service via multiple incomplete HTTP requests because the web server (based on gSOAP 2.8…
published 2019-03-17 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-16526
- cvss
- 7.5
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 13.8%
- EPSS 13.8% chance of exploitation in 30 days, percentile 96%
- public exploits
- 1
- Exploit-DB
Summary
Sricam IP CCTV cameras are vulnerable to denial of service via multiple incomplete HTTP requests because the web server (based on gSOAP 2.8.x) is configured for an iterative queueing approach (aka non-threaded operation) with a timeout of several seconds.
Timeline
- First public exploit (EDB-46261)
- Published
Exploit prediction
13.78% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- EDB-46261 Sricam gSOAP 2.8 - Denial of Service dos, 2019-01-28
- packetstormsecurity.com http://packetstormsecurity.com/files/151377/Sricam-gSOAP-2.8-Denial-Of-Service.html referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P |
References
-
exploit-db.com
/exploits/46261/
exploit, third-party-advisory, vdb-entry
-
packetstormsecurity.com
/files/151377/Sricam-gSOAP-2.8-Denial-Of-Service.html
exploit, third-party-advisory, vdb-entry
-
github.com
/bitfu/sricam-gsoap2.8-dos-exploit
third-party-advisory
Sources
- CVE List CVE-2019-6973
- NVD CVE-2019-6973
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.