CVE-2016-10140

This CVE (CVE-2016-10140) affects ZoneMinder 1.29/1.30 where the Apache HTTP Server configuration bundled with ZoneMinder allows remote unauthenticated access to web root directories via /events, enabling information disclosure (viewing CCTV images) and authentication bypass. The root cause is mi...

CVE-2016-10140

Information disclosure and authentication bypass vulnerability exists in the Apache HTTP Server configuration bundled with ZoneMinder v1.30 and v1.29, which allows a remote unauthenticated attacker to browse all directories in the web root, e.g., a remote unauthenticated attacker can view all CCT...

CVE-2016-10140

Information disclosure and authentication bypass vulnerability exists in the Apache HTTP Server configuration bundled with ZoneMinder v1.30 and v1.29, which allows a remote unauthenticated attacker to browse all directories in the web root, e.g., a remote unauthenticated attacker can view all CCT...

Credentials Accessible in Siemens-Branded CCTV Cameras

Vanderbilt Industries has provided a firmware update for more than a dozen Siemens-branded IP-based closed circuit TV cameras that patches a serious, remotely exploitable vulnerability. The flaw, CVE-2016-9155, could allow an attacker to gain admin credentials by sending certain crafted requests,...

Cross-Site Request Forgery (CSRF) Vulnerability in AVTECH Devices

AVTECH, founded in 1996, is one of the world's leading CCTV manufacturers. The main products are surveillance equipment, network cameras, network video recorders and so on. A cross-site request forgery CSRF vulnerability exists in AVTECH devices. An attacker who successfully exploits the...

Botnet Powered by 25,000 CCTV Devices Uncovered

A botnet comprised entirely of internet-enabled closed circuit TV devices used a barrage of HTTP requests to knock a small jewelry store offline for days. Researchers who came across the botnet recently said they weren’t surprised that IoT devices were being used to carry out a distributed denial...

IoT Botnet — 25,000 CCTV Cameras Hacked to launch DDoS Attack

The Internet of Things IoTs or Internet-connected devices are growing at an exponential rate and so are threats to them. Due to the insecure implementation, these Internet-connected embedded devices, including Smart TVs, Refrigerators, Microwaves, Set-top boxes, Security Cameras and printers, are...

Multiple CCTV-DVR Vendors RCE Vulnerability - Active Check

The remote CCTV-DVR system is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Warning! CCTV Cameras Sold on Amazon Come with Pre-Installed Malware

Be careful while buying any off-brand electronics from Amazon, as they could end up infecting you. Recently, independent security researcher Mike Olsen discovered that the CCTV surveillance devices sold on Amazon came with pre-installed malware. Olsen discovered this nasty secret after he bought ...

A remote code execution vulnerability affects over 7 0 different CCTV-DVR vendor of vulnerability analysis-vulnerability warning-the black bar safety net

0x00 causes A foreigner reading thePOINT OF SALE MALWARE: THE FULL STORY OF THE BACKOFF TROJAN OPERATIONthis paper, on the paper inside the digital thieves of the first through the invasion of the CCTV system to identify the target belongs to the retailers, and then further invasion of POS machin...

CCTV-DVR Vendors - Remote Code Execution

Exploit for hardware platform in category remote exploits !/usr/bin/python Blog post: http://www.kerneronsec.com/2016/02/remote-code-execution-in-cctv-dvrs-of.html ''' Vendors List Ademco ATS Alarmes technolgy and ststems Area1Protection Avio Black Hawk Security Capture China security systems...

CCTV-DVR Remote Code Execution

!/usr/bin/python Blog post - http://www.kerneronsec.com/2016/02/remote-code-execution-in-cctv-dvrs-of.html from sys import argv import optparse from urlparse import urlparse from re import compile import socket import requests from requests.exceptions import ConnectionError, Timeout,...

Remote Code Execution in CCTV-DVR

来源链接： http://www.kerneronsec.com/2016/02/remote-code-execution-in-cctv-dvrs-of.html This post is going to be a follow up from a research which dates back to December 2014, called "The Backoff POS Trojan operation". Back then, one of the key conclusions highlighted from the report is that fraudste...

Multiple CCTV-DVR Vendors - Remote Code Execution

Multiple CCTV-DVR Vendors - Remote Code Execution !/usr/bin/python Blog post: http://www.kerneronsec.com/2016/02/remote-code-execution-in-cctv-dvrs-of.html ''' Vendors List Ademco ATS Alarmes technolgy and ststems Area1Protection Avio Black Hawk Security Capture China security systems Cocktail...

Multiple CCTV-DVR Vendors - Remote Code Execution

!/usr/bin/python Blog post: http://www.kerneronsec.com/2016/02/remote-code-execution-in-cctv-dvrs-of.html ''' Vendors List Ademco ATS Alarmes technolgy and ststems Area1Protection Avio Black Hawk Security Capture China security systems Cocktail Service Cpsecured CP PLUS Digital Eye'z no website...

MVPower CCTV Cameras 漏洞

漏洞演示 默认的Web管理接口登录账号 通过默认的帐号admin和空密码能够通过Web管理接口成功登录： 登录后，可以进行实时的图像监控，系统设置等： Web管理接口登录绕过 根据原文描述，Web管理接口登录的认证仅仅是在前端（js/cookie.js）验证了请求Cookie中是否存在“dvrcamcnt”、”dvruser”、”dvrpwd”这三个值： 通过直接在请求中设置对应Cookie值即可正常访问控制后台： 其中dvrcamcnt指的是页面上实时监控画面的数量。 内置未授权访问Shell...

cctv-4.com XSS vulnerability

Vulnerable URL: http://www.cctv-4.com/2013/default.asp?VideoName=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 5568159 Google Pageran...

cctv-9.com XSS vulnerability

Vulnerable URL: http://www.cctv-9.com/2013/default.asp?VideoName=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 8315141 Google Pageran...

Hacking CCTV Cameras to Launch DDoS Attacks

The connected devices, better known as the Internet of Things, have been attracting the significant interest of, not only users but also cyber criminals that are turning them into weapons for cyber war. Due to the insecure implementation of Internet-connected embedded devices, they are routinely...

Bosch Security Systems Dinion NBN-498 Web Interface - XML Injection Vulnerability

Exploit for hardware platform in category web applications Exploit Title: Bosch Security Systems - XML Injection - Dinion NBN-498 Web Interface Date: 01/09/2015 Exploit Author: neom22 Vendor Homepage: http://us.boschsecurity.com Data Sheet:...