PT-2020-6276 · Rubetek · Rv-3406+2

Sergey Zelensky · Published 2020-09-25 · Updated 2020-10-08 · CVE-2020-25748

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rubetek RV-3406, RV-3409, and RV-3411 cameras (firmware versions v342, v339)

Description A Cleartext Transmission issue allows an attacker to intercept and modify video data from the camera, as it is transmitted in an unencrypted form. The attacker can also modify responses from NTP and RTSP servers, forcing the camera to use the changed values. This issue is related to the lack of protection for transmitted data.

Recommendations For firmware versions v342 and v339, consider disabling the transmission of video data until a patch is available to encrypt the data. Restrict access to the camera's network to minimize the risk of exploitation. Avoid using the camera's Wi-Fi functionality until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

BDU:2021-03826

CVE-2020-25748

Affected Products

Rv-3406

Rv-3409

Rv-3411

References · 6

• 🔥 https://github.com/jet-pentest/CVE-2020-25748 · Exploit
• https://bdu.fstec.ru/vul/2021-03826 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-25748 · Security Note
• https://osv.dev/vulnerability/CVE-2020-25748 · Vendor Advisory
• https://vuldb.com/?id.161939 · Note
• https://tenable.com/cve/CVE-2020-25748 · Note