Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

AVer EH6108H+ devices expose passwords in readable form

CVE-2016-6537 · published 10 years ago
Summary

The EH6108H+ video conference system stores user passwords in a simple encoded text format and also sends them in clear text within web cookies. This makes it possible for someone with network access to read the passwords and gain unauthorized access. Update the device firmware to a version that secures password storage and transmission, or restrict network access to trusted users.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
aver eh6108h\+_firmware x9.03.24.00.07l
cpe:2.3:o:aver:eh6108h\+_firmware:x9.03.24.00.07l:*:*:*:*:*:*:*
Original advisory text
AVer Information EH6108H+ devices with firmware X9.03.24.00.07l store passwords in a cleartext base64 format and require cleartext credentials in HTTP Cookie headers, which allows context-dependent...
AVer Information EH6108H+ devices with firmware X9.03.24.00.07l store passwords in a cleartext base64 format and require cleartext credentials in HTTP Cookie headers, which allows context-dependent attacks to obtain sensitive information by reading these strings.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
1% chance of attack within 30 days
Type
CWE-200Information Exposure
Timeline
Published19 Sep 2016
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2016-6537 · NVD
Track software like this
Free during beta