NUUO NVR Web Interface Detection

Binary data nuuonetgearwwwvideodetect.nbin...

Vacron NVR RCE Vulnerability (Oct 2017) - Active Check

Vacron NVR is prone to a remote code execution RCE vulnerability. This vulnerability was known to be exploited by the IoT Botnet SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Vacron NVR IP Surveillance Detection (HTTP)

HTTP based detection of Vacron NVR IP Surveillance. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Netgear ReadyNAS Surveillance Unauthenticated Remote Command Execution

Vulnerability summary The following advisory describes an Unauthenticated Remote Command Execution vulnerability found in Netgear ReadyNAS Surveillance. Netgear ReadyNAS Surveillance – Small businesses and corporate branch offices require a secure way to protect physical assets, but often lack th...

Design/Logic Flaw

On Samsung NVR devices, remote attackers can read the MD5 password hash of the 'admin' account via certain szUserName JSON data to cgi-bin/main-cgi, and login to the device with that hash in the szUserPasswd parameter...

Cross site request forgery (csrf)

Honeywell NVR devices allow remote attackers to create a user account in the admin group by leveraging access to a guest account to obtain a session ID, and then sending that session ID in a userManager.addUser request to the /RPC2 URI. The attacker can login to the device with that new user...

CVE-2017-14263

Honeywell NVR devices allow remote attackers to create a user account in the admin group by leveraging access to a guest account to obtain a session ID, and then sending that session ID in a userManager.addUser request to the /RPC2 URI. The attacker can login to the device with that new user...

CVE-2017-14262

On Samsung NVR devices, remote attackers can read the MD5 password hash of the 'admin' account via certain szUserName JSON data to cgi-bin/main-cgi, and login to the device with that hash in the szUserPasswd parameter...

CVE-2017-14263

Summary of CVE-2017-14263 Affected product: Honeywell NVR devices (network video recorder). Vulnerability details: Remote attackers can create a user account in the admin group by abusing access to a guest account to obtain a session ID, then sending that session ID in a userManager.addUser reque...

CVE-2017-14262

CVE-2017-14262 affects Samsung NVR devices. Remote attackers can read the MD5 hash of the admin password via szUserName JSON data sent to cgi-bin/main-cgi and then use that hash in szUserPasswd to log in. The vulnerability is network-exposed with high impact (confidentiality/integrity/availabilit...

CVE-2017-14262

On Samsung NVR devices, remote attackers can read the MD5 password hash of the 'admin' account via certain szUserName JSON data to cgi-bin/main-cgi, and login to the device with that hash in the szUserPasswd parameter...

CVE-2017-14263

Honeywell NVR devices allow remote attackers to create a user account in the admin group by leveraging access to a guest account to obtain a session ID, and then sending that session ID in a userManager.addUser request to the /RPC2 URI. The attacker can login to the device with that new user...

CVE-2017-14263: Session Fixation

Honeywell NVR devices allow remote attackers to create a user account in the admin group by leveraging access to a guest account to obtain a session ID, and then sending that session ID in a userManager.addUser request to the /RPC2 URI. The attacker can login to the device with that new user...

CVE-2017-14262: Inadequate Encryption Strength

On Samsung NVR devices, remote attackers can read the MD5 password hash of the 'admin' account via certain szUserName JSON data to cgi-bin/main-cgi, and login to the device with that hash in the szUserPasswd parameter...

PT-2017-13331

Name of the Vulnerable Software and Affected Versions Samsung NVR devices affected versions not specified Description The issue allows remote attackers to read the MD5 password hash of the 'admin' account by sending certain szUserName JSON data to the "cgi-bin/main-cgi" API endpoint. This hash ca...

PT-2017-13332

Name of the Vulnerable Software and Affected Versions Honeywell NVR devices affected versions not specified Description The issue allows remote attackers to create a user account in the admin group by leveraging access to a guest account to obtain a session ID, and then sending that session ID in...

Uniview NVR - Password Disclosure

Uniview NVR - Password Disclosure Uniview NVR remote passwords disclosure Author: B1t The Uniview NVR web application does not enforce authorizations on the main.cgi file when requesting json data. It says that you can do anything without authentication, however you must know the request structur...

Uniview NVR - Password Disclosure

Uniview NVR remote passwords disclosure Author: B1t The Uniview NVR web application does not enforce authorizations on the main.cgi file when requesting json data. It says that you can do anything without authentication, however you must know the request structure. In addition, the users' passwor...

CMVISION CM-NVST-MP08 Command Injection Vulnerability

The ddnsserver.cgi script on the device's webserver that runs as root is vulnerable to remote command execution by an authenticated user, with the default password being "admin:admin". The address GET parameter is fed to the command line by the CGI script without sanitization for semicolons,...

Hikvision NVR Buffer Overflow Vulnerability (CNVD-2017-03882)

The Hikvision NVR DS-76xxNI-E1/2 and DS-77xxxNI-E4 are both hard disk recorders from Hikvision, a Chinese company. A buffer overflow vulnerability exists in the Hikvision NVRs. It allows an attacker to cause a denial of service service interruption via a crafted HTTP request i.e. SDK issue...