Finding 3: Web Based Administration Interface Bypass CVE: CVE-2010-4232 The CMNC-200 IP Camera has an administrative web interface that does not handle authentication properly. Using a properly formatted request, an attacker can bypass the authentication mechanism. The first example requires authentication: http://www.ipcamera.com/system.html When a second forward slash is placed after the hostname, authentication is not required. http://www.ipcamera.com//system.html This vulnerability allows an attacker to take full control of the IP Camera. Vendor Response: No response received. Remediation Steps: No patch currently exists for this issue. To limit exposure, network access to these devices should be limited to authorized personnel through the use of Access Control Lists and proper network segmentation.
Related ExploitsTrying to match CVEs (1): CVE-2010-4232
Trying to match OSVDBs (1): 69332
Other Possible E-DB Search Terms: Camtron CMNC-200 IP Camera, Camtron CMNC
|2010-11-13||Camtron CMNC-200 IP Camera - ActiveX Buffer Overflow||Trustwave's...|
|2010-11-13||Camtron CMNC-200 IP Camera - Denial of Service||Trustwave's...|
|2010-11-13||Camtron CMNC-200 IP Camera - Directory Traversal||Trustwave's...|
|2010-11-13||Camtron CMNC-200 IP Camera - Undocumented Default Accounts||Trustwave's...|