PT-2025-48195 · Ace Security · Ace Security Wip-90113 Hd Cameras

Todor Donev · Published 2025-11-26 · Updated 2025-11-29 · CVE-2020-36874

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions ACE SECURITY WIP-90113 HD cameras (affected versions not specified)

Description ACE SECURITY WIP-90113 HD cameras have an issue where configuration information can be disclosed without authentication. The /web/cgi-bin/hi3510/backup.cgi API endpoint allows remote download of a compressed configuration backup without requiring any authentication or authorization. This backup may contain administrative credentials and other sensitive device settings. An unauthenticated remote attacker could obtain this information, potentially leading to further compromise of the camera or the connected network.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2020-36874

Affected Products

Ace Security Wip-90113 Hd Cameras

References · 9

• 🔥 https://packetstorm.news/files/id/156497 · Exploit
• 🔥 https://cxsecurity.com/issue/WLB-2020020137 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-36874 · Security Note
• https://acesecurity.jp/support/top/wip_series/wip-90113 · Note
• https://twitter.com/CVEnew/status/1993810863430476104 · Twitter Post
• https://twitter.com/SecAideInfo/status/1994711644598145094 · Twitter Post
• https://t.me/cveNotify/144149 · Telegram Post
• https://vulncheck.com/advisories/ace-security-wip90113-unauthenticated-config-disclosure · Note
• https://t.me/CVEtracker/38332 · Telegram Post