CVE-2025-67160

CVE-2025-67160 — 基于Vatilon的IP摄像头 概述 基于Vatilon的IP摄像头固件暴露了多个内部Web目录，无需身份验证即可访问。当嵌入式Web服务器启用了目录索引时，未认证的攻击者可以访问如/cgi-bin/、/view/、/css/、/img/、/img2/、/js/、/js2/和/onvif/等目录，从而泄露内部脚本、配置页面和敏感的实现细节。 这种暴露使攻击者能够研究Web界面的内部结构，并可能加剧其他漏洞（如认证绕过或未授权配置访问）的影响。 漏洞类型： 不正确的访问控制 影响： 远程信息泄露 CVSS v3.1： 7.5...

CVE-2025-63667

CVE-2025-63667 — Vatilon 系列 IP 摄像头漏洞证据（脱敏版） 摘要 多款基于 Vatilon 的 IP 摄像头（已观测到的品牌：SIMICAM、KEVIEW、ASECAM）在未验证凭据正确性 的情况下发放 Session-Id 令牌。此缺陷允许未经身份验证的攻击者获取有效会话，并通过暴露的 API 端点访问管理员数据，例如明文账户凭据。 漏洞类型： 访问控制不当 / 身份验证不当 影响： 远程信息泄露、权限提升 CVSS v3.1： 7.5（AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N） 受影响设备（已观测） 品牌| devtype|...

CVE-2025-67159

CVE-2025-67159 — 基于 Vatilon 的 IP 摄像头 摘要 基于 Vatilon 的 IP 摄像头固件在 /cgi-bin/web.cgi API 中存在认证绕过和明文凭据泄露漏洞 。Web 接口在处理包含 username 和 password 参数的请求时，以明文方式处理且未验证认证状态或会话上下文，允许未经认证的攻击者检索敏感设备信息和管理数据。 漏洞类型： 不正确的访问控制 / 不当认证 影响： 远程信息泄露、权限提升 CVSS v3.1： 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N 受影响设备（已观察到） 厂商| 产品 /...

CVE-2025-67159

Vatilon v1.12.37-20240124 was discovered to transmit user credentials in plaintext...

CVE-2025-67160

An issue in Vatilon v1.12.37-20240124 allows attackers to access sensitive directories and files via a directory traversal...

CVE-2025-67160

An issue in Vatilon v1.12.37-20240124 allows attackers to access sensitive directories and files via a directory traversal...

CVE-2025-67159

Vatilon v1.12.37-20240124 was discovered to transmit user credentials in plaintext...

CVE-2025-67159

Vatilon v1.12.37-20240124 was discovered to transmit user credentials in plaintext...

CVE-2025-67160

An issue in Vatilon v1.12.37-20240124 allows attackers to access sensitive directories and files via a directory traversal...

Vatilon IP Cameras 安全漏洞

Vatilon IP Cameras are a series of IP cameras from China-based Vatilon Vatilon. A security vulnerability exists in Vatilon IP Cameras version v1.12.37-20240124, which stems from susceptibility to directory traversal attacks that could lead to access to sensitive directories and files...

CVE-2025-67160

CVE-2025-67160 affects Vatilon v1.12.37-20240124. The issue is a directory traversal vulnerability that allows an unauthenticated attacker (network access, low complexity) to access sensitive directories and files, with a high confidentiality impact and no data integrity or availability impact re...

CVE-2025-67159

Vatilon v1.12.37-20240124 was discovered to transmit user credentials in plaintext...

Vatilon IP Cameras 安全漏洞

Vatilon IP Cameras are a series of IP cameras from China-based Vatilon Vatilon. A security vulnerability exists in Vatilon IP Cameras version v1.12.37-20240124, which originates from transmitting user credentials in clear text...

CVE-2025-67159

Vatilon v1.12.37-20240124 was discovered to transmit user credentials in plaintext...

PT-2026-1105

Name of the Vulnerable Software and Affected Versions Vatilon version 1.12.37-20240124 Description The software transmits user credentials in plaintext. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability...

CVE-2025-67160

An issue in Vatilon v1.12.37-20240124 allows attackers to access sensitive directories and files via a directory traversal...

Vatilon-based IP Cameras Authentication Bypass / Credential Exposure

Vatilon-based IP camera firmware contains an authentication bypass and plaintext credential exposure vulnerability in the /cgi-bin/web.cgi API. The web interface processes requests containing username and password parameters in plaintext without validating authentication state or session context,...

PT-2026-1103

Name of the Vulnerable Software and Affected Versions Vatilon version 1.12.37-20240124 Description An issue allows attackers to access sensitive directories and files via a directory traversal. Recommendations At the moment, there is no information about a newer version that contains a fix for th...

CVE-2025-67160

An issue in Vatilon v1.12.37-20240124 allows attackers to access sensitive directories and files via a directory traversal...

CVE-2025-67159

CVE-2025-67159 affects Vatilon IP camera firmware v1.12.37-20240124. The root issue is plaintext transmission of credentials via the /cgi-bin/web.cgi API, with the web interface processing username/password in plaintext without proper authentication/session validation. This enables unauthenticate...