Default credentials

2020-06-0419:15:00

PRIOn knowledge base

www.prio-n.com

7.9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

42.5%

JSON

Castel NextGen DVR v1.0.0 stores and displays credentials for the associated SMTP server in cleartext. Low privileged users can exploit this to create an administrator user and obtain the SMTP credentials.

CPENameOperatorVersion
nextgen_dvr_firmwareeq1.0.0

CPE	Name	Operator	Version
	nextgen_dvr_firmware	eq	1.0.0

References

packetstormsecurity.com/files/157954/Castel-NextGen-DVR-1.0.0-Bypass-CSRF-Disclosure.html

seclists.org/fulldisclosure/2020/Jun/8

www.securitymetrics.com/blog/attackers-known-unknown-authorization-bypass