CVE-2015-8279

Exploitation likely. EPSS gives it a 51% chance of exploitation in the next 30 days. No fix published yet.

CVSS 3.08.6High EPSS percentile99th51% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2016-01-15Updated 2026-05-06Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Samsung Web ViewerAffected: ≤ 1.0.0.193Upgrade to: after 1.0.0.193Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether you operate Samsung SRN-1670D devices with Web Viewer 1.0.0.193.
Remove the device web interface from direct internet access and allow access only from trusted internal networks or a secured remote-access service.
No fixed version is available in the published findings; ask Samsung or your support provider for a supported firmware or replacement recommendation.
Review firewall or web-access logs for unexpected HTTP requests to the device and change any passwords or secrets stored on it if exposure is suspected.

May need vendor or contractor work

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Web Viewer 1.0.0.193 on Samsung SRN-1670D devices allows remote attackers to read arbitrary files via a request to an unspecified PHP script.

In plain language

Written by AI from the record

Businesses using Web Viewer 1.0.0.193 on Samsung SRN-1670D devices should act, because an internet-reachable device may expose private files to outsiders.

Unauthenticated remote arbitrary-file read in Web Viewer 1.0.0.193, triggered by a crafted HTTP request to an unspecified PHP script.

If you're affected

Private device file exposure
Configuration disclosure
Possible credential exposure
Privacy incident risk

What is it

This is a flaw in the device's built-in web viewing software that can let an outsider request files they should not be able to see. It is like a locked office where a particular form handed to reception causes private filing cabinets to be opened.

Who is affected

This matters to you if you use Web Viewer on Samsung SRN-1670D devices. It is especially relevant where the device's web interface can be reached over the network; the attacker does not need an account, and it is a risk only if they can reach that interface.

How urgent is it

This is AMBER: an attacker who can reach the device can retrieve private files with a specially formed web request. It is not listed in CISA's known-exploited catalog and no public exploit code is on record, but the expected likelihood of exploitation is high enough to justify promptly restricting access.

What to do — in detail

Confirm the model, installed Web Viewer version, and every network path to its HTTP management interface, including port forwards, remote-management gateways, and vendor-access links. The findings identify Web Viewer 1.0.0.193 on Samsung SRN-1670D devices; no fixed version or supported branch target is published, so do not assume a routine upgrade resolves it.

Until Samsung or a qualified support provider supplies a supported remediation path, block inbound internet access to the device web interface, restrict it to designated management addresses, and use a secured remote-access service for off-site administration. If the device must remain reachable, place it behind network filtering and minimize who can access it.

Review firewall, proxy, and device-access records for unusual HTTP requests directed at the device. Because the vulnerable PHP script is unspecified and the finding says access may occur without detection, treat unexplained access as a reason to rotate device and related service credentials, assess exposed files, and consider replacing unsupported equipment. There is no CISA KEV remediation due date because this CVE is not listed in KEV.

Technical context

CVSS 8.6 High (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N). The issue is CWE-264 and permits unauthenticated network-based arbitrary file read through a crafted HTTP request to an unspecified PHP script; no user interaction is required and the service is reachable by default. CISA KEV does not list this CVE, and no public exploit code is recorded. EPSS predicts 51.4% likelihood (99th percentile), with a falling trend; this is a prediction, not confirmation of exploitation. Press attention is rising.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

51% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

21 events over 3904 days, from the signal feeds we watch.

2026-09-23EPSS band changemoderate → highepss band change
2026-09-21EPSS band changehigh → moderateepss band change
2026-09-06EPSS band changemoderate → highepss band change
2026-09-05EPSS band changehigh → moderateepss band change
2026-08-31EPSS band changemoderate → highepss band change
2026-08-29EPSS band changehigh → moderate

Affected products

samsungcommercial · KRaka samsung electronics
- web viewerEmbeddedMobile Apps / android-app

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Scored 8.6 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity NoneNo integrity impact
Availability NoneNo availability impact

Weaknesses

CWE-264No name in the record

Sources

References in the record

kb.cert.org/vuls/id/913000

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Web Viewer, not every advisory.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account