The file management interface of iCatch DVR contains broken access control which allows the attacker to remotely manipulate arbitrary file.