PT-2018-11316 · Sv3C · Sv3C L-Series Hd Camera

Published 2018-10-19 · Updated 2019-01-28 · CVE-2018-12666

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SV3C L-SERIES HD CAMERA version 2.3.4.2103-S50-NTD-B20170508B

Description The issue allows remote attackers to bypass authentication and gain administrator access. This is possible because the device improperly identifies users only by the authentication level sent in the cookies. An attacker can exploit this by setting the authLevel cookie to 255.

Recommendations For version 2.3.4.2103-S50-NTD-B20170508B, as a temporary workaround, consider restricting access to the device's administrative interface until a patch is available. Avoid relying solely on the authLevel cookie for authentication. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2018-12666

Affected Products

Sv3C L-Series Hd Camera

References · 3

• 🔥 https://bishopfox.com/news/2018/10/sv3c-l-series-hd-camera-multiple-vulnerabilities · Exploit
• https://osv.dev/vulnerability/CVE-2018-12666 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-12666 · Security Note