PT-2013-4564 · Airlive · Airlive Wl2600Cam

Jonás Ropero Castillo · Published 2013-10-11 · Updated 2013-10-15 · CVE-2013-3686

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions AirLive WL2600CAM (affected versions not specified)

Description The issue allows remote attackers to obtain the administrator password. This is achieved through the cgi-bin/operator/param endpoint, specifically by utilizing a list action.

Recommendations For AirLive WL2600CAM, consider restricting access to the cgi-bin/operator/param endpoint until a patch is available. As a temporary workaround, limit the exposure of the device to the internet to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2013-3686

Affected Products

Airlive Wl2600Cam

References · 3

• 🔥 http://seclists.org/fulldisclosure/2013/Jun/84 · Exploit
• 🔥 https://exploit-db.com/exploits/26174 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-3686 · Security Note