PT-2024-7543 · Unknown · D3D Security Ip Camera

Priyanka R. Chaudhary · Published 2024-10-01 · Updated 2024-10-14 · CVE-2024-47789

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions D3D Security IP Camera (affected versions not specified)

Description The issue is related to the transmission of critical information in plain text, allowing a remote attacker to obtain user credentials by crafting a special HTTP packet. This is due to a weak authentication scheme in the HTTP header protocol, where the authorization tag contains a Base-64 encoded username and password. The vulnerability can be exploited by a remote attacker, leading to the exposure of user credentials of the targeted device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

BDU:2024-08940

CVE-2024-47789

Affected Products

D3D Security Ip Camera

References · 13

• https://bdu.fstec.ru/vul/2024-08940 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-47789 · Security Note
• https://twitter.com/the_yellow_fall/status/1842382135417778525 · Twitter Post
• https://t.me/cvenotify/97983 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1842224784945336563 · Twitter Post
• https://t.me/cvedetector/6975 · Telegram Post
• https://twitter.com/CVEnew/status/1842188364683850058 · Twitter Post
• https://cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0314 · Note
• https://twitter.com/CveFindCom/status/1842188295284883794 · Twitter Post
• https://vuldb.com/ja/?id.279227 · Note
• https://cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0314 · Note
• https://t.me/latest_high_impact_cve/1250 · Telegram Post
• https://twitter.com/FatmaYl73528380/status/1842977692825923865 · Twitter Post