Remote Authentication Bypass - Swann DVR4 SecuraNet

2009.02.11
Credit: tez
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-22

Dear BugTraq Readers, It is possible to download the configuration containing usernames/passwords to this CCTV DVR which is being marketed by Swann Security (suspect that it is a rebranded AVTech unit) [tez@tetris ~]$ curl http://192.168.2.100/../../var/run/vy_netman.cfg <snip>Padmin111111 (the above are the default username/password on the unit; which I have yet to change - access to other units found via Google have demonstrated that this technique does work) Once you have the username/password from this file, you can log in to the unit via http://[IP Address]/ and authenticate with those details. It is strongly suggested that owners of these units secure them by configuring an IP-based ACL on their firewall/router in order to ensure that unwanted parties cannot view the cameras attached to this unit. This vulnerability has been reported to Swann Security and as of yet, they have not published a firmware update for this nor responded to my request for access to firmware source under the terms of the GPL. As per standard disclosure practices, the vendor was given 30 days to publish a patch/fix or announce this themselves - so far, they have not done so hence my own disclosure. Regards, Terry Froy Spilsby Internet Solutions http://www.spilsby.net/

Referencje:

http://www.securityfocus.com/bid/33716
http://www.securityfocus.com/archive/1/archive/1/500789/100/0/threaded
http://secunia.com/advisories/33861
http://packetstorm.linuxsecurity.com/0902-exploits/cctv-disclose.txt
http://osvdb.org/51897


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top