PT-2020-7391 · Zavio · Zavio Ip Cameras

Fernando Miranda + 2 · Published 2020-01-29 · Updated 2020-02-01 · CVE-2013-2567

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Zavio IP Cameras versions 1.6.03 and earlier

Description: An Authentication Bypass issue exists in the web interface of Zavio IP Cameras due to a hardcoded admin account found in boa.conf. This allows a remote malicious user to obtain sensitive information.

Recommendations: For versions 1.6.03 and earlier, consider disabling the web interface until a patch is available to prevent exploitation of the hardcoded admin account. Restrict access to the boa.conf file to minimize the risk of sensitive information disclosure. Avoid using the default admin account in the affected Zavio IP Cameras until the issue is resolved.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2013-2567

Affected Products

Zavio Ip Cameras

References · 8

• 🔥 http://coresecurity.com/advisories/zavio-IP-cameras-multiple-vulnerabilities · Exploit
• 🔥 https://exploit-db.com/exploits/25815 · Exploit
• 🔥 http://exploit-db.com/exploits/25815 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-2567 · Security Note
• http://securityfocus.com/bid/60189 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/84568 · Note
• https://packetstormsecurity.com/files/cve/CVE-2013-2567 · Note
• https://t.me/cvenotify/605 · Telegram Post