vendor:
DVR IP Camera
by:
Meisam Monsef
7.5
CVSS
HIGH
Authentication Bypass
287
CWE
Product Name: DVR IP Camera
Affected Version From: All Versions
Affected Version To: All Versions
Patch Exists: No
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Chrome
2015
Security IP Camera Star Vision DVR Authentication Bypass
The vulnerability allows an attacker to bypass authentication of the Star Vision DVR IP Camera. The attacker can open the Chrome browser, enter the IP address or domain to see the login screen of the camera, press the F12 key to open the browser console, click the Console tab and enter the code 'login_set(1,1,1,1);'. Then, the attacker can go to page view2.html and access the camera.
Mitigation:
The vendor should implement proper authentication mechanisms to prevent unauthorized access.
