LG DVR LE6016D - Remote File Disclosure Vulnerability (0day)

vendor:

LG DVR LE6016D

by:

Yakir Wizman

CVSS

CRITICAL

Remote File Disclosure

N/A

CWE

Product Name: LG DVR LE6016D

Affected Version From: All versions

Affected Version To: All versions

Patch Exists: NO

Related CWE: none

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2015

LG DVR LE6016D – Remote File Disclosure Vulnerability (0day)

No authentication (login) is required to exploit this vulnerability. The LG DVR application is prone to a remote file disclosure vulnerability. An attacker can exploit this vulnerability to retrieve stored files on server such as '/etc/passwd' and '/etc/shadow' by using a simple url request which made by browser. More over, an attacker may be able to compromise encrypted login credentials for or retrieve the device's administrator password allowing them to directly access the device's configuration control panel.

Mitigation:

N/A

Source

Exploit-DB raw data:

----------------------------------------------------------------------
Title		: LG DVR LE6016D - Remote File Disclosure Vulnerability (0day)
CVE-ID		: none
Product		: LG
Affected 	: All versions
Impact		: Critical
Remote		: Yes
Product link: http://www.lgecommercial.com/security-en/products/analog-product/analog-dvr/lg-LE6016D
Reported	: 10/02/2015
Author		: Yakir Wizman, yakir.wizman@gmail.com


Vulnerability description:
----------------------------------------------------------------------
No authentication (login) is required to exploit this vulnerability. 
The LG DVR application is prone to a remote file disclosure vulnerability.
An attacker can exploit this vulnerability to retrieve stored files on server such as '/etc/passwd' and '/etc/shadow' by using a simple url request which made by browser.
More over, an attacker may be able to compromise encrypted login credentials for or retrieve the device's administrator password allowing them to directly access the device's configuration control panel.


Proof of concept:
----------------------------------------------------------------------
The following simple url request will retrieve '/etc/shadow' file:
http://127.0.0.1:1234/etc/shadow


~eof.