CVE-2015-8279: Web Viewer 1.0.0.193 on Samsung SRN-1670D devices allows remote attackers to read arbitrary files via a request to an unspecified PHP script.

PriorityP270high8.6CVSS 3.0

AVNACLPRNUINSCCHINAN

EXPLOIT

EPSS

51.38%

98.8th percentile

Web Viewer 1.0.0.193 on Samsung SRN-1670D devices allows remote attackers to read arbitrary files via a request to an unspecified PHP script.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
hanwhasecurity	web_viewer	—	—
samsung	web_viewer	<= 1.0.0.193	—

Detection & IOCsextracted from sources · hover to see the quote

urlcslog_export.php?path=/root/php_modules/lighttpd/sbin/userpw↗

path/root/php_modules/lighttpd/sbin/userpw↗

path/cslog_export.php↗

path/network_ssl_upload.php↗

path/upload/↗

cookieIESEVEN=1↗

cookieIESEVEN=1; NVR_DATA1=#{nvr_d1}; NVR_DATA2=#{nvr_d2}; NVR_DATA3=#{nvr_d3}; NVR_DATA4=#{nvr_d4}; NVR_DATA7=#{nvr_d7}; NVR_DATA8=#{nvr_d8}; NVR_DATA9=#{nvr_d9}↗

path/login↗

→Detect LFI exploitation attempts targeting the credential file via cslog_export.php with the path parameter pointing to /root/php_modules/lighttpd/sbin/userpw ↗
→Monitor POST requests to network_ssl_upload.php with multipart/form-data containing a .php filename in the attachFile field, indicating an attempted PHP webshell upload ↗
→Alert on GET requests to /upload/*.php on Samsung SRN-1670D devices, which indicates execution of an uploaded PHP webshell ↗
→Flag HTTP sessions using the IESEVEN=1 cookie combined with NVR_DATA* session cookies against Samsung NVR web interfaces, as this pattern is used by the exploit for authenticated access ↗
→Detect the exploit's login POST to /login with form fields data1 (base64 username), data2 (SHA256 password hash), data3, and data4 as indicators of automated credential abuse ↗
→Correlate a GET to cslog_export.php?path=/root/php_modules/lighttpd/sbin/userpw followed shortly by a POST to /login and then a POST to /network_ssl_upload.php as a multi-stage attack chain for CVE-2015-8279 + CVE-2017-16524 ↗

·CVE-2015-8279 (LFI) only affects Samsung SRN-1670D devices running Web Viewer version 1.0.0.193; detections should be scoped to this specific device/version to avoid false positives ↗
·The LFI credential leak (CVE-2015-8279) requires no authentication, making it exploitable by unauthenticated remote attackers; detections on cslog_export.php should not filter by auth state ↗

CVSS provenance

nvdv3.08.6HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.