CVE-2025-67160

CVE-2025-67160 — 基于Vatilon的IP摄像头 概述 基于Vatilon的IP摄像头固件暴露了多个内部Web目录，无需身份验证即可访问。当嵌入式Web服务器启用了目录索引时，未认证的攻击者可以访问如/cgi-bin/、/view/、/css/、/img/、/img2/、/js/、/js2/和/onvif/等目录，从而泄露内部脚本、配置页面和敏感的实现细节。 这种暴露使攻击者能够研究Web界面的内部结构，并可能加剧其他漏洞（如认证绕过或未授权配置访问）的影响。 漏洞类型： 不正确的访问控制 影响： 远程信息泄露 CVSS v3.1： 7.5...

CVE-2025-63667

CVE-2025-63667 — VatilonベースIPカメラの脆弱性証拠（サニタイズ版） 概要 複数のVatilonベースIPカメラ（確認されたブランド: SIMICAM、KEVIEW、ASECAM）は、認証情報の正当性を検証せずにSession-Id トークンを発行します。この欠陥により、認証されていない攻撃者が有効なセッションを取得し、公開されたAPIエンドポイントを通じて平文のアカウント認証情報など管理データにアクセスできます。 脆弱性の種類: 不適切なアクセス制御 / 不適切な認証 影響: リモート情報漏洩、権限昇格 CVSS v3.1: 7.5...

CVE-2025-67159

CVE-2025-67159 — VatilonベースのIPカメラ 概要 VatilonベースのIPカメラファームウェアには、/cgi-bin/web.cgi APIにおける認証バイパスと平文資格情報の露出脆弱性 が存在します。Webインターフェースは、認証状態やセッションコンテキストを検証せずに、平文でusernameおよびpasswordパラメータを含むリクエストを処理するため、認証されていない攻撃者がデバイスの機密情報や管理データを取得できる可能性があります。 脆弱性の種類: 不適切なアクセス制御 / 不適切な認証 影響: リモート情報漏洩、権限昇格 CVSS v3.1: 7.5...

CVE-2025-67159

Vatilon v1.12.37-20240124 was discovered to transmit user credentials in plaintext...

CVE-2025-67160

An issue in Vatilon v1.12.37-20240124 allows attackers to access sensitive directories and files via a directory traversal...

CVE-2025-67160

An issue in Vatilon v1.12.37-20240124 allows attackers to access sensitive directories and files via a directory traversal...

CVE-2025-67159

Vatilon v1.12.37-20240124 was discovered to transmit user credentials in plaintext...

CVE-2025-67159

Vatilon v1.12.37-20240124 was discovered to transmit user credentials in plaintext...

CVE-2025-67160

An issue in Vatilon v1.12.37-20240124 allows attackers to access sensitive directories and files via a directory traversal...

Vatilon IP Cameras 安全漏洞

Vatilon IP Cameras are a series of IP cameras from China-based Vatilon Vatilon. A security vulnerability exists in Vatilon IP Cameras version v1.12.37-20240124, which stems from susceptibility to directory traversal attacks that could lead to access to sensitive directories and files...

CVE-2025-67160

CVE-2025-67160 affects Vatilon v1.12.37-20240124. The issue is a directory traversal vulnerability that allows an unauthenticated attacker (network access, low complexity) to access sensitive directories and files, with a high confidentiality impact and no data integrity or availability impact re...

CVE-2025-67159

Vatilon v1.12.37-20240124 was discovered to transmit user credentials in plaintext...

Vatilon IP Cameras 安全漏洞

Vatilon IP Cameras are a series of IP cameras from China-based Vatilon Vatilon. A security vulnerability exists in Vatilon IP Cameras version v1.12.37-20240124, which originates from transmitting user credentials in clear text...

CVE-2025-67160

An issue in Vatilon v1.12.37-20240124 allows attackers to access sensitive directories and files via a directory traversal...

PT-2026-1105

Name of the Vulnerable Software and Affected Versions Vatilon version 1.12.37-20240124 Description The software transmits user credentials in plaintext. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability...

CVE-2025-67159

Vatilon v1.12.37-20240124 was discovered to transmit user credentials in plaintext...

Vatilon-based IP Cameras Authentication Bypass / Credential Exposure

Vatilon-based IP camera firmware contains an authentication bypass and plaintext credential exposure vulnerability in the /cgi-bin/web.cgi API. The web interface processes requests containing username and password parameters in plaintext without validating authentication state or session context,...

PT-2026-1103

Name of the Vulnerable Software and Affected Versions Vatilon version 1.12.37-20240124 Description An issue allows attackers to access sensitive directories and files via a directory traversal. Recommendations At the moment, there is no information about a newer version that contains a fix for th...

CVE-2025-67160

An issue in Vatilon v1.12.37-20240124 allows attackers to access sensitive directories and files via a directory traversal...

CVE-2025-67159

CVE-2025-67159 affects Vatilon IP camera firmware v1.12.37-20240124. The root issue is plaintext transmission of credentials via the /cgi-bin/web.cgi API, with the web interface processing username/password in plaintext without proper authentication/session validation. This enables unauthenticate...