CVE-2015-8279: Samsung SRN-1670D Web Viewer arbitrary file read via PHP script

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityUnauthenticated remote file read on an internet-reachable NVR with a very high EPSS score, though no confirmed in-the-wild exploitation is recorded.

What it is

Web Viewer 1.0.0.193 on Samsung SRN-1670D devices exposes an unspecified PHP script that fails to enforce access controls, letting a remote attacker read arbitrary files. Because the device is a network video recorder, files reachable this way can include configuration and credential material, so the flaw matters for any unit exposed beyond a trusted network.

Impact

An attacker gains read access to arbitrary files on the device, which can expose stored credentials, configuration and other sensitive data. The scope change in the CVSS vector indicates the compromise can affect resources beyond the vulnerable component itself.

Attack surface

Reachable over the network through the Web Viewer HTTP interface with no authentication and no user interaction, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The exact PHP script and request format are not specified in the record.

Exploitation

Not listed in CISA KEV and no public exploit reference is given, but EPSS is 0.51379 (98.9th percentile), indicating a high predicted likelihood of exploitation activity.

What to do

• Apply the vendor fix for Web Viewer on SRN-1670D devices; if no patch is available, isolate or retire the affected units.
• Remove direct internet exposure of the Web Viewer interface and restrict access to a management VLAN or VPN.
• Require authentication and network-level access control in front of the Web Viewer where the product cannot be updated.
• Rotate any credentials or keys stored on or managed by affected devices, since file read may have exposed them.
• Monitor vendor and CERT/CC advisories for updated guidance on this device line.

Detection

• Review Web Viewer and web server logs for requests to PHP scripts with path traversal or unexpected file parameters.
• Alert on access to the Web Viewer interface from untrusted or external source addresses.
• Baseline normal file requests to the device and flag reads of configuration, credential or system files.
• Watch for anomalous outbound connections from NVR devices that could indicate data exfiltration after file read.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.