VelotiSmart WiFi B-380 Camera Directory Traversal

`Title: Vulnerability in VelotiSmart Wifi - Directory Traversal  
Date: 12-07-2018  
Scope: Directory Traversal  
Platforms: Unix  
Author: Miguel Mendez Z  
Vendor: VelotiSmart  
Version: B380  
CVE: CVE-2018a14064  
  
  
Vulnerability description  
-------------------------  
- The vulnerability that affects the device is LFI type in the uc-http service 1.0.0. What allows to obtain information of configurations, wireless scanned networks, sensitive directories, etc. Of the device.  
  
Vulnerable variable:  
http://domain:80/../../etc/passwd  
  
Exploit link:  
https://github.com/s1kr10s/ExploitVelotiSmart  
  
Poc:  
https://medium.com/@s1kr10s/velotismart-0day-ca5056bcdcac  
  
`