CVE-2020-25169

The affected Reolink P2P products do not sufficiently protect data transferred between the local device and Reolink servers. This can allow an attacker to access sensitive information, such as camera feeds...

CVE-2020-23826

The Yale WIPC-303W 2.21 through 2.31 camera is vulnerable to remote command execution RCE through command injection via the HTTP API. NOTE: This may be a duplicate of CVE-2020-10176...

CVE-2020-23826

The Yale WIPC-303W 2.21 through 2.31 camera is vulnerable to remote command execution RCE through command injection via the HTTP API. NOTE: This may be a duplicate of CVE-2020-10176...

Information disclosure

The affected Reolink P2P products do not sufficiently protect data transferred between the local device and Reolink servers. This can allow an attacker to access sensitive information, such as camera feeds...

Code injection

An issue was discovered on Geeni GNC-CW013 doorbell 1.8.1 devices. A vulnerability exists in the RTSP service that allows a remote attacker to take full control of the device with a high-privileged account. By sending a crafted message, an attacker is able to remotely deliver a telnet session. An...

CVE-2020-29001

The CVE-2020-29001 issue affects Geeni GNC-CW028 Camera (2.7.2), Geeni GNC-CW025 Doorbell (2.9.5), Merkury MI-CW024 Doorbell (2.9.6), and Merkury MI-CW017 Camera (2.9.6). The root cause is a static username and password embedded in the ppsapp RESTful API, enabling a remote attacker with a high-pr...

CVE-2020-29000

An issue was discovered on Geeni GNC-CW013 doorbell 1.8.1 devices. A vulnerability exists in the RTSP service that allows a remote attacker to take full control of the device with a high-privileged account. By sending a crafted message, an attacker is able to remotely deliver a telnet session. An...

CVE-2020-29000

CVE-2020-29000 affects Geeni GNC-CW013 doorbell (firmware 1.8.1). The RTSP service vulnerability allows a remote attacker with network access and high privileges to remotely gain full control, including delivering a Telnet session and accessing the camera system via DNS control. No concrete remed...

CVE-2020-28999

An issue was discovered in Apexis Streaming Video Web Application on Geeni GNC-CW013 doorbell 1.8.1 devices. A remote attacker can take full control of the camera with a high-privileged account. The vulnerability exists because a static username and password are compiled into a shared library...

CVE-2020-28999

CVE-2020-28999 affects Geeni GNC-CW013 doorbell (Apexis Streaming Video Web Application, version 1.8.1). The issue arises from a shared library (libhipcam.so) that ships with a hardcoded/static username and password, enabling a remote attacker with high-privilege access to take full control of th...

PT-2021-11109

Name of the Vulnerable Software and Affected Versions: Reolink P2P products affected versions not specified Description: The issue concerns insufficient protection of data transferred between local devices and Reolink servers, potentially allowing attackers to access sensitive information like...

Geeni GNC-CW013 Trust Management Issues Vulnerability

Geeni GNC-CW013 is a webcam from Geeni USA. A security vulnerability exists in the Geeni GNC-CW013 doorbell version 1.8.1. An attacker can take full control of the camera using a highly privileged account...

Geeni Multiple Product Security Vulnerabilities

Geeni GNC-CW028 and so on are products of Geeni USA.Geeni GNC-CW028 is an indoor webcam.Geeni GNC-CW025 is an indoor webcam.Merkury MI-CW024 and so on are products of Merkury USA.Merkury MI-CW024 is an indoor webcam.Merkury MI-CW017 is an indoor webcam. Geeni A security vulnerability exists in...

ASSA ABLOY Yale WIPC-303W Operating System OS Command Injection Vulnerability

ASSA ABLOY Yale WIPC-303W is a home smart camera from ASSA ABLOY, Sweden. The ASSA ABLOY Yale WIPC-303W 2.21 through 2.31 camera suffers from an operating system command injection vulnerability that stems from command injection in the HTTP API and is susceptible to Remote Command Execution RCE...

Rostelecom CS-C2SHW Buffer Error Vulnerability

The Rostelecom CS-C2SHW is a camera device. A buffer error vulnerability exists in Rostelecom CS-C2SHW 5.0.082.1. The vulnerability stems from an error in the AgentGreen service parsing broadcast discovery UDP messages. Sending a packet that is too small will result in an attempt to allocate a...

CVE-2020-25169: Cleartext Transmission of Sensitive Information

The affected Reolink P2P products do not sufficiently protect data transferred between the local device and Reolink servers. This can allow an attacker to access sensitive information, such as camera feeds...

CVE-2020-29001: Cleartext Storage of Sensitive Information

An issue was discovered on Geeni GNC-CW028 Camera 2.7.2, Geeni GNC-CW025 Doorbell 2.9.5, Merkury MI-CW024 Doorbell 2.9.6, and Merkury MI-CW017 Camera 2.9.6 devices. A vulnerability exists in the RESTful Services API that allows a remote attacker to take full control of the camera with a...

PT-2021-11618

Name of the Vulnerable Software and Affected Versions: Apexis Streaming Video Web Application on Geeni GNC-CW013 doorbell version 1.8.1 Description: A remote attacker can take full control of the camera with a high-privileged account due to a static username and password being compiled into a...

PT-2021-11620

Name of the Vulnerable Software and Affected Versions: Geeni GNC-CW028 Camera version 2.7.2 Geeni GNC-CW025 Doorbell version 2.9.5 Merkury MI-CW024 Doorbell version 2.9.6 Merkury MI-CW017 Camera version 2.9.6 Description: A vulnerability exists in the RESTful Services API that allows a remote...

CVE-2020-0404

A flaw linked list corruption in the Linux kernel for USB Video Class driver functionality was found in the way user connects web camera to the USB port. A local user could use this flaw to crash the system. Mitigation To mitigate this issue, prevent the module uvcvideo from being loaded. Please...