PT-2022-16759 · Alecto · Alecto Dvc-215Ip

Published 2022-02-24 · Updated 2022-03-03 · CVE-2022-24610

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Alecto DVC-215IP camera versions 63.1.1.173 and below

Description The issue concerns the visibility of the Wi-Fi passphrase in the settings of the Alecto DVC-215IP camera. By modifying or removing the style of the password field in the wireless settings, the password becomes visible. This could potentially grant access to an internal network connected to the camera.

Recommendations For Alecto DVC-215IP camera versions 63.1.1.173 and below, consider restricting access to the wireless settings until a fix is available. As a temporary workaround, avoid editing or removing the style of the password field to prevent the passphrase from being exposed.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2022-24610

Affected Products

Alecto Dvc-215Ip

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2022-24610 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24610 · Vendor Advisory
• https://support.alecto.nl/nl/support/solutions/articles/48001210271-kwetsbaarheid-vulnerability-firmware-below-version-63-1-1-173 · Vendor Advisory