PT-2021-13503

Name of the Vulnerable Software and Affected Versions: NVIDIA camera firmware affected versions not specified Description: The issue concerns a vulnerability in NVIDIA camera firmware that allows a highly privileged attacker to cause unauthorized modification to camera resources. This may result ...

CVE-2021-1113: Improper Access Control

NVIDIA camera firmware contains a difficult to exploit vulnerability where a highly privileged attacker can cause unauthorized modification to camera resources, which may result in complete denial of service and partial loss of data integrity for all clients...

CVE-2021-1110: Improper Input Validation

NVIDIA Linux kernel distributions on Jetson Xavier contain a vulnerability in camera firmware where a user can change input data after validation, which may lead to complete denial of service and serious data corruption of all kernel components...

CVE-2021-1109: Undefined Security Weakness

NVIDIA camera firmware contains a multistep, timing-related vulnerability where an unauthorized modification by camera resources may result in loss of data integrity or denial of service across several streams...

UDP Technology IP 摄像头认证绕过 RCE 漏洞（CVE-2021-33543、CVE-2021-33544）

...

Jetson Linux Input Validation Error Vulnerability (CNVD-2021-102834)

Jetson Linux is a software application. High-performance, low-power computing for deep learning and computer vision makes it an ideal platform for computationally intensive projects. Jetson Linux suffers from an input validation error vulnerability that stems from user-supplied input in the camer...

CVE-2021-23849

A vulnerability in the web-based interface allows an unauthenticated remote attacker to trigger actions on an affected system on behalf of another user CSRF - Cross Site Request Forgery. This requires the victim to be tricked into clicking a malicious link or opening a malicious website while bei...

CVE-2021-23849 Cross Site Request Forgery (CSRF) vulnerability in web based management interface

A vulnerability in the web-based interface allows an unauthenticated remote attacker to trigger actions on an affected system on behalf of another user CSRF - Cross Site Request Forgery. This requires the victim to be tricked into clicking a malicious link or opening a malicious website while bei...

CVE-2021-23849

CVE-2021-23849 concerns Bosch IP cameras with a web-based management interface. The vulnerability is CSRF: an unauthenticated attacker can induce actions on behalf of a logged-in user by convincing them to click a malicious link or visit a malicious site, while the victim is authenticated to the ...

NVIDIA Jetson Permission Licensing and Access Control Vulnerabilities

Nvidia NVIDIA Jetson is an embedded system development module from Nvidia Corporation. A privilege permission and access control issue vulnerability exists in various pieces of NVIDIA Jetson software, which arises from unauthorized modification of camera resources. An attacker could exploit this...

NVIDIA Jetson input validation error vulnerability

Jetson Linux is a software application. High-performance, low-power computing for deep learning and computer vision makes it an ideal platform for computationally intensive projects. Jetson Linux suffers from an input validation error vulnerability that stems from user-supplied input in the camer...

CVE-2021-23849

A vulnerability in the web-based interface allows an unauthenticated remote attacker to trigger actions on an affected system on behalf of another user CSRF - Cross Site Request Forgery. This requires the victim to be tricked into clicking a malicious link or opening a malicious website while bei...

Denver smart wifi camera shc-150 telnet command execution vulnerability

Denve is a European supplier of consumer electronics. denver smart wifi camera shc-150 telnet command execution vulnerability, which can be exploited by attackers to execute arbitrary code...

A week in security (July 26 – August 1)

Last week on Malwarebytes Labs: OSX.XLoader hides little except its main purpose: What we learned in the installation process. The Clubhouse database “breach” is likely a non-breach. Here’s why. Kaseya Unitrends has unpatched vulnerabilities that could help attackers expand a breach. UDP Technolo...

Panasonic Sanyo CCTV Network Camera 2.03-0x - Cross-Site Request Forgery (Change Password)

Exploit Title: Panasonic Sanyo CCTV Network Camera 2.03-0x - 'Disable Authentication / Change Password' CSRF Date: 13.07.2021 Exploit Author: LiquidWorm Vendor Homepage: https://www.panasonic.com !-- Panasonic Sanyo CCTV Network Camera 2.03-0x CSRF Disable Authentication / Change Password Vendor:...

Panasonic Sanyo CCTV Network Camera 2.03-0x Cross Site Request Forgery

!-- Panasonic Sanyo CCTV Network Camera 2.03-0x CSRF Disable Authentication / Change Password Vendor: Panasonic Corporation | SANYO Electric Co., Ltd. Product web page: https://www.panasonic.com https://www.sanyo-av.com https://panasonic.net/sanyo/cs/index.html Affected version: Model: VCC-HD5600...

Denver IP Camera SHO-110 Snapshot Disclosure

Exploit Title: Denver IP Camera SHO-110 - Unauthenticated Snapshot Date: 28 July 2021 Exploit Author: Ivan Nikolsky enty8080 Vendor Homepage: https://denver.eu/products/smart-home-security/denver-sho-110/c-1024/c-1243/p-3826 Version: Denver SHO-110 all firmware versions Tested on: Denver SHO-110...

Telnet Service Unauthenticated Access

The vulnerability of the Telnet service provided by the Wi-Fi cameras of Rubetek models RV-3406, RV-3409, and RV-3411 is related to authentication deficiencies. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to RTSP and ONFIV services. This...

Rubetek Telnet Full Control

The vulnerability of the telnet service provided by the microprogrammed Wi-Fi cameras from Rubetek, models RV-3406, RV-3409, and RV-3411, is related to the use of pre-installed registration data. Exploiting this vulnerability can allow a remote attacker to gain full control over the device...

Denver IP Camera SHO-110 - Unauthenticated Snapshot

Exploit Title: Denver IP Camera SHO-110 - Unauthenticated Snapshot Date: 28 July 2021 Exploit Author: Ivan Nikolsky enty8080 Vendor Homepage: https://denver.eu/products/smart-home-security/denver-sho-110/c-1024/c-1243/p-3826 Version: Denver SHO-110 all firmware versions Tested on: Denver SHO-110...