CVE-2018-16946

🗓️ 12 Sep 2018 01:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 69 Views🌐 WEB

LG smart network camera devices have broken access control, allowing attackers to download sensitive files without authentication

Reporter	Title	Published	Views	Family All 8
0day.today	LG Smart IP Camera 1508190 - Backup File Download Exploit	16 Sep 201800:00	–	zdt
Check Point Advisories	LG Smart IP Camera Authentication Bypass (CVE-2018-16946)	2 Oct 201800:00	–	checkpoint_advisories
Cvelist	CVE-2018-16946	12 Sep 201801:00	–	cvelist
Exploit DB	LG Smart IP Camera 1508190 - Backup File Download	12 Sep 201800:00	–	exploitdb
exploitpack	LG Smart IP Camera 1508190 - Backup File Download	12 Sep 201800:00	–	exploitpack
NVD	CVE-2018-16946	12 Sep 201801:29	–	nvd
Packet Storm	LG Smart IP Camera 1508190 File Disclosure	12 Sep 201800:00	–	packetstorm
Prion	Improper access control	12 Sep 201801:29	–	prion

NVD

Node

lg lnb5110_firmwareRange1310250–1508190

AND

lg lnb5110Match-

Node

lg lnb5320_firmwareRange1310250–1508190

AND

lg lnb5320Match-

Node

lg lnb5320r_firmwareRange1310250–1508190

AND

lg lnb5320rMatch-

Node

lg lnb7210_firmwareRange1310250–1508190

AND

lg lnb7210Match-

Node

lg lnd3230r_firmwareRange1310250–1508190

AND

lg lnd3230rMatch-

Node

lg lnd5110_firmwareRange1310250–1508190

AND

lg lnd5110Match-

Node

lg lnd5110r_firmwareRange1310250–1508190

AND

lg lnd5110rMatch-

Node

lg lnd5220r_firmwareRange1310250–1508190

AND

lg lnd5220rMatch-

Node

lg lnd7210_firmwareRange1310250–1508190

AND

lg lnd7210Match-

Node

lg lnd7210r_firmwareRange1310250–1508190

AND

lg lnd7210rMatch-

Node

lg lnu3230r_firmwareRange1310250–1508190

AND

lg lnu3230rMatch-

Node

lg lnu5110r_firmwareRange1310250–1508190

AND

lg lnu5110rMatch-

Node

lg lnu5320r_firmwareRange1310250–1508190

AND

lg lnu5320rMatch-

Node

lg lnu7210r_firmwareRange1310250–1508190

AND

lg lnu7210rMatch-

Node

lg lnv5110r_firmwareRange1310250–1508190

AND

lg lnv5110rMatch-

Node

lg lnv5320r_firmwareRange1310250–1508190

AND

lg lnv5320rMatch-

Node

lg lnv7210_firmwareRange1310250–1508190

AND

lg lnv7210Match-

Node

lg lnv7210r_firmwareRange1310250–1508190

AND

lg lnv7210rMatch-

Source	Link
exploit-db	www.exploit-db.com/exploits/45394/
github	www.github.com/EgeBalci/LG-Smart-IP-Device-Backup-Download

Parameter	Position	Path	Description	CWE
file	query param	/download.php	Unauthenticated access to backup/configuration download via file parameter.	CWE-552
GetDeviceInformation	query param	/httpapi?GetDeviceInformation	Test for default admin credentials via HTTP API without authentication.	CWE-552

21 Nov 2024 03:53Current

7.4High risk

Vulners AI Score7.4

CVSS 25

CVSS 37.5

EPSS0.11007

CWE-552