PT-2018-1033 · Master · Master Ipcamera01

Daniele Linguaglossa + 1 · Publicado 2018-01-15 · Atualizado 2018-02-05 · CVE-2018-5724

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MASTER IPCAMERA01 version 3.3.4.2103

Description The issue is related to unauthenticated configuration download and upload in the MASTER IPCAMERA01 device. This can be exploited through the restore.cgi endpoint, allowing a remote attacker to impact the confidentiality, integrity, and availability of protected information.

Recommendations For MASTER IPCAMERA01 version 3.3.4.2103, as a temporary workaround, consider restricting access to the restore.cgi endpoint until a patch is available. Additionally, limit configuration downloads and uploads to authorized personnel only. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

BDU:2018-00332

CVE-2018-5724

Produtos afetados

Master Ipcamera01

Referências · 6

• 🔥 http://syrion.me/blog/master-ipcam · Exploit
• 🔥 https://exploit-db.com/exploits/43693 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-5724 · Nota de Segurança
• https://bdu.fstec.ru/vul/2018-00332 · Nota de Segurança
• https://packetstormsecurity.com/files/145935/Master-IP-CAM-01-Hardcoded-Password-Unauthenticated-Access.html · Nota
• https://osv.dev/vulnerability/CVE-2018-5724 · Aviso do Fabricante