PT-2021-11618 · Geeni · Geeni Gnc-Cw013

Published 2021-01-26 · Updated 2021-02-03 · CVE-2020-28999

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Apexis Streaming Video Web Application on Geeni GNC-CW013 doorbell version 1.8.1

Description: A remote attacker can take full control of the camera with a high-privileged account due to a static username and password being compiled into a shared library (libhipcam.so) used for the streaming camera service.

Recommendations: For version 1.8.1, consider disabling the streaming camera service temporarily until a patch is available to prevent exploitation. Restrict access to the libhipcam.so library to minimize the risk of unauthorized control. Avoid using the default compiled username and password in the shared library until the issue is resolved.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2020-28999

Affected Products

Geeni Gnc-Cw013

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-28999 · Security Note
• https://osv.dev/vulnerability/CVE-2020-28999 · Vendor Advisory
• https://gist.github.com/tj-oconnor/74f9ebbad668f3a7ce31a968452190d7 · Note
• https://t.me/cvenotify/9302 · Telegram Post
• https://support.mygeeni.com/hc/en-us · Note