PT-2019-6845 · Capture+4 · Capture Cctv+4

Alejandro Ramos + 1 · Published 2019-10-30 · Updated 2019-11-05 · CVE-2013-1391

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Hunt CCTV (affected versions not specified) Capture CCTV (affected versions not specified) Hachi CCTV (affected versions not specified) NoVus CCTV (affected versions not specified) Well-Vision Inc DVR systems (affected versions not specified)

Description The issue allows a remote attacker to bypass authentication in the web interface of the affected systems, enabling them to retrieve the device configuration.

Recommendations For Hunt CCTV, update to a version that addresses the authentication bypass issue. For Capture CCTV, update to a version that addresses the authentication bypass issue. For Hachi CCTV, update to a version that addresses the authentication bypass issue. For NoVus CCTV, update to a version that addresses the authentication bypass issue. For Well-Vision Inc DVR systems, update to a version that addresses the authentication bypass issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2013-1391

Affected Products

Capture Cctv

Hachi Cctv

Hunt Cctv

Novus Cctv

Well-Vision Inc Dvr Systems

References · 7

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/misc/dvr_config_disclosure.rb · Exploit
• 🔥 https://exploit-db.com/exploits/38248 · Exploit
• 🔥 https://securityfocus.com/bid/57579/info · Exploit
• 🔥 http://securitybydefault.com/2013/01/12000-grabadores-de-video-expuestos-en.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-1391 · Security Note
• https://rapid7.com/db/modules/auxiliary/scanner/misc/dvr_config_disclosure · Note
• https://t.me/cibsecurity/7787 · Telegram Post