CVE-2018-12674

The SV3C HD Camera L-SERIES V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B stores the username and password within the cookies of a session. If an attacker gained access to these session cookies, it would be possible to gain access to the username and password of the logged-in...

CVE-2018-12668

CVE-2018-12668 affects SV3C L-SERIES HD CAMERA devices V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B, caused by a hard-coded password. The vulnerability is exploitable over network with no authentication or user interaction, potentially compromising confidentiality, integrity,...

CVE-2018-12666

The CVE-2018-12666 entry concerns SV3C L-SERIES HD CAMERA V2.3.4.2103-S50-NTD-B20170508B devices where authentication is based solely on a cookie value. The underlying issue allows remote attackers to bypass authentication and gain administrator access by setting the authLevel cookie to 255. The ...

CVE-2018-12668

SV3C L-SERIES HD CAMERA V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B devices have a Hard-coded Password...

PT-2018-11321

Name of the Vulnerable Software and Affected Versions SV3C L-SERIES HD CAMERA versions V2.3.4.2103-S50-NTD-B20170508B through V2.3.4.2103-S50-NTD-B20170823B Description The issue allows OS Command Injection, which can be exploited by attackers. No information is provided about the estimated numbe...

CVE-2018-12667: Improper Authentication

The SV3C HD Camera L-SERIES V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B is affected by an improper authentication vulnerability that allows requests to be made to back-end CGI scripts without a valid session. This vulnerability could be used to read and modify the...

CVE-2018-12670: Improper Neutralization of Special Elements used in an OS Command

SV3C L-SERIES HD CAMERA V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B devices allow OS Command Injection...

CVE-2018-12671: Exposure of Sensitive Information to an Unauthorized Actor

An attacker with remote access to the SV3C HD Camera L-SERIES V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B web interface can disclose information about the camera including all password sets set within the camera. This information can then be used to gain access to the web...

CVE-2018-12675: URL Redirection to Untrusted Site

The SV3C HD Camera L-SERIES V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B does not perform origin checks on URLs that the camera's web interface redirects a user to. This can be leveraged to send a user to an unexpected endpoint...

CVE-2018-12672: Improper Neutralization of Input During Web Page Generation

The SV3C HD Camera L-SERIES V2.3.4.2103-S50-NTD-B20170508B does not perform proper validation on user-supplied input and is vulnerable to cross-site scripting attacks. If proper authorization was implemented, this vulnerability could be leveraged to perform actions on behalf of another user or th...

PT-2018-11317

Name of the Vulnerable Software and Affected Versions SV3C HD Camera versions prior to the fixed version Description The issue is related to improper authentication, allowing unauthorized requests to be made to back-end CGI scripts without a valid session. This could potentially be used to read a...

PT-2018-11325

Name of the Vulnerable Software and Affected Versions SV3C HD Camera versions V2.3.4.2103-S50-NTD-B20170508B through V2.3.4.2103-S50-NTD-B20170823B Description The issue allows an attacker to gain access to the username and password of a logged-in account if they obtain the session cookies. This ...

PT-2018-11319

Name of the Vulnerable Software and Affected Versions SV3C L-SERIES HD CAMERA versions V2.3.4.2103-S50-NTD-B20170508B through V2.3.4.2103-S50-NTD-B20170823B Description The issue allows remote authenticated users to reset arbitrary accounts. This can be achieved by sending a request to the...

PT-2018-11318

Name of the Vulnerable Software and Affected Versions SV3C L-SERIES HD CAMERA versions V2.3.4.2103-S50-NTD-B20170508B through V2.3.4.2103-S50-NTD-B20170823B Description The issue concerns a hard-coded password in the affected devices. Recommendations For versions V2.3.4.2103-S50-NTD-B20170508B an...

PT-2018-11323

Name of the Vulnerable Software and Affected Versions SV3C HD Camera version L-SERIES V2.3.4.2103-S50-NTD-B20170508B Description The issue concerns a lack of proper validation on user-supplied input, making the camera susceptible to cross-site scripting attacks. This could potentially allow actio...

PT-2018-11326

Name of the Vulnerable Software and Affected Versions SV3C HD Camera versions V2.3.4.2103-S50-NTD-B20170508B through V2.3.4.2103-S50-NTD-B20170823B Description The issue concerns the camera's web interface, which does not perform origin checks on URLs that it redirects users to. This can be...

CVE-2018-12666: Improper Authentication

SV3C L-SERIES HD CAMERA V2.3.4.2103-S50-NTD-B20170508B devices improperly identifies users only by the authentication level sent in the cookies, which allow remote attackers to bypass authentication and gain administrator access by setting the authLevel cookie to 255...

PT-2018-11324

Name of the Vulnerable Software and Affected Versions SV3C HD Camera versions V2.3.4.2103-S50-NTD-B20170508B through V2.3.4.2103-S50-NTD-B20170823B Description An attacker with remote access to the camera's web interface can disclose sensitive information, including details about the camera...

PT-2018-11316

Name of the Vulnerable Software and Affected Versions SV3C L-SERIES HD CAMERA version 2.3.4.2103-S50-NTD-B20170508B Description The issue allows remote attackers to bypass authentication and gain administrator access. This is possible because the device improperly identifies users only by the...

PT-2018-11322

Name of the Vulnerable Software and Affected Versions SV3C HD Camera versions V2.3.4.2103-S50-NTD-B20170508B through V2.3.4.2103-S50-NTD-B20170823B Description The issue allows an attacker with remote access to the camera's web interface to disclose information about the camera, including all...