PT-2019-12137 · Vstarcam+1 · Vstarcam Library+1

Published 2019-04-08 · Updated 2019-04-11 · CVE-2019-11014

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions VStarCam library versions (affected versions not specified) Eye4 application versions (affected versions not specified)

Description The issue allows an attacker to create a fake camera server, impersonate the real camera, and intercept client communications. This is achieved by exploiting the lack of spoofing prevention in the VStarCam library and shared object used by the Eye4 application. The attacker can flood the client with responses, causing it to deny service to the original camera and communicate exclusively with the fake server. As a result, the client sends login details, including username and password, to the attacker's fake camera server.

Recommendations For VStarCam library, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Eye4 application, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2019-11014

Affected Products

Eye4 Application

Vstarcam Library

References · 3

• 🔥 http://blog.0x42424242.in/2019/03/vstarcam-investigational-security_22.html · Exploit
• 🔥 http://blog.0x42424242.in/2019/03/vstarcam-investigational-security.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-11014 · Security Note