Published: 30/10/2019 Updated: 05/11/2019

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 505

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

Authentication bypass vulnerability in the the web interface in Hunt CCTV, Capture CCTV, Hachi CCTV, NoVus CCTV, and Well-Vision Inc DVR systems allows a remote malicious user to retrieve the device configuration.

Vulnerable Product	Search on Vulmon	Subscribe to Product
huntcctv dvr-04ch_firmware -
huntcctv dvr-04nc_firmware -
huntcctv dvr-08ch_firmware -
huntcctv dvr-08nc_firmware -
huntcctv dvr-16ch_firmware -
huntcctv dr6-704a4h_firmware -
huntcctv dr6-708a4h_firmware -
huntcctv dr6-7316a4h_firmware -
huntcctv dr6-7316a4hl_firmware -
huntcctv hdr-04kd_firmware -
huntcctv hdr-08kd_firmware -
capturecctv cdr_0410ve_firmware -
capturecctv cdr_0820vde_firmware -
hachi hv-04rd_pro_firmware -
hachi hv-08rd_pro_firmware -
novuscctv nv-dvr1204_firmware -
novuscctv nv-dvr1208_firmware -
novuscctv nv-dvr1216_firmware -
vsp tw-dvr604_firmware -
vsp tw-dvr616_firmware -

source: wwwsecurityfocuscom/bid/57579/info Multiple Hunt CCTV devices are prone to a remote information-disclosure vulnerability Successful exploits will allow attackers to obtain sensitive information, such as credentials, that may aid in further attacks curl -v wwwexamplecom/DVRcfg | strings |grep -i USER ...

Hunt CCTV and generic brands suffer from a file disclosure vulnerability that discloses authentication information ...

CWE-287 https://www.rapid7.com/db/modules/auxiliary/scanner/misc/dvr_config_disclosure http://www.securitybydefault.com/2013/01/12000-grabadores-de-video-expuestos-en.html https://www.securityfocus.com/bid/57579/info https://nvd.nist.gov https://www.exploit-db.com/exploits/38248/

CVE-2013-1391

Vulnerability Summary

Vulnerability Trend

Exploits

References

Vulmon Search

About

Products

Connect