Vulnerability CVE-2013-3540


Published: 2013-10-04   Modified: 2013-10-05

Description:
Cross-site request forgery (CSRF) vulnerability in cgi-bin/admin/usrgrp.cgi in AirLive POE2600HD, POE250HD, POE200HD, OD-325HD, OD-2025HD, OD-2060HD, POE100HD, and possibly other camera models allows remote attackers to hijack the authentication of administrators for requests that add users.

See advisories in our WLB2 database:
Topic
Author
Date
High
Airlive CSRF / Traversal / Disclosure / Denial Of Service
Eliezer Varade L...
13.06.2013

Type:

CWE-352

(Cross-Site Request Forgery (CSRF))

Vendor: Ovislink
Product: Airlive poe2600hd 
Product: Airlive od-2025hd 
Product: Airlive poe100hd 
Product: Airlive poe250hd 
Product: Airlive od-2060hd 
Product: Airlive poe200hd 

CVSS2 => (AV:N/AC:M/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
6.8/10
6.4/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial

 References:
http://seclists.org/fulldisclosure/2013/Jun/84

Related CVE
CVE-2013-3687
AirLive POE2600HD, POE250HD, POE200HD, OD-325HD, OD-2025HD, OD-2060HD, POE100HD, and possibly other camera models use cleartext to store sensitive information, which allows attackers to obtain passwords, user names, and other sensitive information by...
CVE-2013-3686
cgi-bin/operator/param in AirLive WL2600CAM and possibly other camera models allows remote attackers to obtain the administrator password via a list action.
CVE-2013-3541
Directory traversal vulnerability in cgi-bin/admin/fileread in AirLive WL2600CAM and possibly other camera models allows remote attackers to read arbitrary files via a .. (dot dot) in the READ.filePath parameter.
CVE-2013-3539
Cross-site request forgery (CSRF) vulnerability in the command/user.cgi in Sony SNC CH140, SNC CH180, SNC CH240, SNC CH280, SNC DH140, SNC DH140T, SNC DH180, SNC DH240, SNC DH240T, SNC DH280, and possibly other camera models allows remote attackers t...

Copyright 2019, cxsecurity.com

 

Back to Top