{"id":"01M6MYE45CN8QXDSKZ38GA6D3P","product_id":"01M6MYE3NRN9DYBECKW2DJ55YW","channel":"api","origin":"imported","status":"unverified","verdict":"vulnerable","summary":"SEC Consult reported predictable XMEye cloud identifiers and an undocumented default account in 2018; applicability to a current device requires separate verification.","body_md":null,"method":null,"source_method":null,"sources":[{"title":"XMEye P2P Cloud security research","url":"https://sec-consult.com/blog/detail/millions-of-xiongmai-video-surveillance-devices-can-be-hacked-via-cloud-feature-xmeye-p2p-cloud/","publisher":"SEC Consult","publishedAt":"2018-10-09"},{"title":"CVE-2018-17917 official record","url":"https://cveawg.mitre.org/api/cve/CVE-2018-17917","publisher":"CVE Program","publishedAt":null},{"title":"CVE-2018-17919 official record","url":"https://cveawg.mitre.org/api/cve/CVE-2018-17919","publisher":"CVE Program","publishedAt":null}],"playbook_version":null,"agent":"seed/curation","ai_model":null,"proof_of_possession":0,"reviewed_at":null,"review_note":"Source accuracy correction: Removed invented Bluetooth-name identifier, unsupported present-day family-wide conclusion, guessed severities and conflation of cloud-ID enumeration with firmware updates. This is not independent device verification.","created_at":1793851855020,"updated_at":1793917832000,"slug":"xmeye-based-cameras-and-nvrs","vendor":null,"model":"XMEye-based cameras and NVRs","category":"ip_camera","product_status":"reported","handle":"isitspying","display_name":"isitspying maintainers","user_role":"maintainer","url":"https://isitspying.com/r/01M6MYE45CN8QXDSKZ38GA6D3P","product_url":"https://isitspying.com/p/xmeye-based-cameras-and-nvrs","findings":[{"id":"accuracy:01M6MYE45CN8QXDSKZ38GA6D3P:0","report_id":"01M6MYE45CN8QXDSKZ38GA6D3P","kind":"known_cve","severity":"unrated","detail":"CVE-2018-17917: cloud identifiers could be enumerated from MAC addresses.","ai_model":null},{"id":"accuracy:01M6MYE45CN8QXDSKZ38GA6D3P:1","report_id":"01M6MYE45CN8QXDSKZ38GA6D3P","kind":"known_cve","severity":"unrated","detail":"CVE-2018-17919: an undocumented default account permitted access to video streams.","ai_model":null}],"contacted_hosts":[],"evidence":[]}