Arteco Web Client DVR/NVR Session Hijacking Vulnerability

The session identifier used by Arteco Web Client DVR/NVR is of an insufficient length and can be brute forced, allowing a remote attacker to obtain a valid session, bypass authentication, and disclose the live camera stream. !/usr/bin/env python3 Arteco Web Client DVR/NVR 'SessionId' Cookie Brute...

Arteco Web Client DVR/NVR Session Hijacking

!/usr/bin/env python3 Arteco Web Client DVR/NVR 'SessionId' Cookie Brute Force Session Hijacking Exploit Vendor: Arteco S.U.R.L. Product web page: https://www.arteco-global.com Affected version: n/a Summary: Arteco DVR/NVR is a mountable industrial surveillance server ideal for those who need to...

Arteco Web Client DVR/NVR 'SessionId' Cookie Brute Force Session Hijacking Exploit

Summary Arteco DVR/NVR is a mountable industrial surveillance server ideal for those who need to manage IP video surveillance designed for medium to large installations that require high performance and reliability. Arteco can handle IP video sources from all major international manufacturers and...

VulnCheck KEV: CVE-2013-6023

Directory traversal vulnerability in the TVT TD-2308SS-B DVR with firmware 3.2.0.P-3520A-00 and earlier allows remote attackers to read arbitrary files via .. dot dot in the URI...

Exploit for CVE-2018-9995

This is a PoC exploit for CVE-2018-9995, a vulnerability in DVR systems that allows for the exposure of credentials. The exploit is written in Python and uses the requests library to send HTTP requests to the DVR system. The exploit targets various DVR systems, including Novo, CeNova, QSee, Pulni...

VulnCheck KEV: CVE-2025-34054

An unauthenticated command injection vulnerability exists in AVTECH DVR devices via Search.cgi?action=cgiquery. The use of wget without input sanitization allows attackers to inject shell commands through the username or queryb64str parameters, executing commands as root. Exploitation evidence wa...

PT-2020-14748

Name of the Vulnerable Software and Affected Versions Gallagher Command Centre versions 7.70 and earlier Gallagher Command Centre versions 7.80 prior to 7.80.960MR2 Gallagher Command Centre versions 7.90 prior to 7.90.991MR5 Gallagher Command Centre versions 8.00 prior to 8.00.1161MR5 Gallagher...

Castel NextGen DVR Cross-Site Request Forgery Vulnerability

Castel NextGen DVR is a network video device. A cross-site request forgery vulnerability exists in Castel NextGen DVR v1.0.0. The vulnerability stems from a WEB application that does not adequately validate that a request is coming from a trusted user. An attacker could use this vulnerability to...

Castel NextGen DVR Administrator Creation Vulnerability

Castel NextGen DVR is a network video device. A security vulnerability exists in Castel NextGen DVR that allows remote attackers to exploit the vulnerability by submitting a special request that could create an administrator user or obtain SMTP authentication credentials...

Castel NextGen DVR Security Bypass Vulnerability

Castel NextGen DVR is a network video device. A security vulnerability exists in Castel NextGen DVR. The vulnerability stems from the program failing to check if a request comes from an administrator. An attacker can exploit the vulnerability to create/modify file libraries, create/modify users,...

Castel NextGen DVR Management Feature Elevation of Privilege Vulnerability

Castel NextGen DVR is a network video device. A security vulnerability exists in the Castel NextGen DVR management feature that allows a remote attacker can exploit the vulnerability to submit a special request that can elevate privileges and gain administrator privileges...

Castel NextGen DVR 1.0.0 Bypass / CSRF / Disclosure

All issues are associated with Castel NextGen DVR v1.0.0 and have been resolved in v1.0.1. ------------------------------- CVE-2020-11679 Original Disclosure https://www.securitymetrics.com/blog/attackers-known-unknown-authorization-bypass Description A low privileged user can call functionality...

CVE-2020-11682

Castel NextGen DVR v1.0.0 is vulnerable to CSRF in all state-changing request. A RequestVerificationToken is set by the web interface, and included in requests sent by web interface. However, this token is not verified by the application: the token can be removed from all requests and the request...

CVE-2020-11682

Castel NextGen DVR v1.0.0 is vulnerable to CSRF in all state-changing request. A RequestVerificationToken is set by the web interface, and included in requests sent by web interface. However, this token is not verified by the application: the token can be removed from all requests and the request...

Cross site request forgery (csrf)

Castel NextGen DVR v1.0.0 is vulnerable to CSRF in all state-changing request. A RequestVerificationToken is set by the web interface, and included in requests sent by web interface. However, this token is not verified by the application: the token can be removed from all requests and the request...

CVE-2020-11679

Castel NextGen DVR v1.0.0 is vulnerable to privilege escalation through the Adminstrator/Users/Edit/:UserId functionality. Adminstrator/Users/Edit/:UserId fails to check that the request was submitted by an Administrator. This allows a normal user to escalate their privileges by adding additional...

CVE-2020-11681

Castel NextGen DVR v1.0.0 stores and displays credentials for the associated SMTP server in cleartext. Low privileged users can exploit this to create an administrator user and obtain the SMTP credentials...

CVE-2020-11680

Castel NextGen DVR v1.0.0 is vulnerable to authorization bypass on all administrator functionality. The application fails to check that a request was submitted by an administrator. Consequently, a normal user can perform actions including, but not limited to, creating/modifying the file store,...

CVE-2020-11679

Castel NextGen DVR v1.0.0 is vulnerable to privilege escalation through the Adminstrator/Users/Edit/:UserId functionality. Adminstrator/Users/Edit/:UserId fails to check that the request was submitted by an Administrator. This allows a normal user to escalate their privileges by adding additional...

CVE-2020-11680

Castel NextGen DVR v1.0.0 is vulnerable to authorization bypass on all administrator functionality. The application fails to check that a request was submitted by an administrator. Consequently, a normal user can perform actions including, but not limited to, creating/modifying the file store,...