PT-2021-19510 · Night Owl · Nightowl Wdb-20-V2

Tj-Oconnor · Published 2021-05-06 · Updated 2022-07-12 · CVE-2021-31793

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions NightOwl WDB-20-V2 version WDB-20-V2 20190314

Description The issue allows an unauthenticated user to gain access to snapshots and video streams from the doorbell. The binary app offers a web server on port 80 that allows an unauthenticated user to take a snapshot from the doorbell camera via the "/snapshot" URI.

Recommendations For NightOwl WDB-20-V2 version WDB-20-V2 20190314, as a temporary workaround, consider restricting access to the "/snapshot" URI until a patch is available. Avoid using the web server on port 80 to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2021-31793

Affected Products

Nightowl Wdb-20-V2

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-31793 · Security Note
• https://osv.dev/vulnerability/CVE-2021-31793 · Vendor Advisory
• https://gist.github.com/tj-oconnor/16a4116050bbcb4717315f519b944f1f · Note
• https://cloud.binary.ninja/embed/f4400a22-c438-403a-bf2a-939ca44a4f6b · Note