PT-2018-11611 · Kerui · Kerui Wifi Endoscope Camera

Utku Sen · Publicado 2018-10-22 · Atualizado 2019-01-29 · CVE-2018-13115

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions KERUI Wifi Endoscope Camera (YPC99) (affected versions not specified)

Description The issue concerns a lack of authentication in the KERUI Wifi Endoscope Camera, allowing unauthorized access to watch or block the camera stream. Specifically, the RTSP server on port 7070 is vulnerable, as it accepts commands without proper authentication. An attacker can use the STOP command to stop streaming and the SETSSID command to disconnect a user.

Recommendations For KERUI Wifi Endoscope Camera (YPC99), consider disabling the RTSP server on port 7070 until a proper authentication mechanism is implemented to prevent unauthorized access to the camera stream. Restrict access to the STOP and SETSSID commands to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2018-13115

Produtos afetados

Kerui Wifi Endoscope Camera

Referências · 2

• 🔥 https://utkusen.com/blog/multiple-vulnerabilities-on-kerui-endoscope-camera.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-13115 · Nota de Segurança