26 lines
No EOL
820 B
Text
26 lines
No EOL
820 B
Text
Finding 3: Web Based Administration Interface Bypass
|
|
CVE: CVE-2010-4232
|
|
|
|
The CMNC-200 IP Camera has an administrative web
|
|
interface that does not handle authentication properly.
|
|
Using a properly formatted request, an attacker can bypass
|
|
the authentication mechanism.
|
|
|
|
The first example requires authentication:
|
|
http://www.ipcamera.com/system.html
|
|
|
|
When a second forward slash is placed after the hostname,
|
|
authentication is not required.
|
|
http://www.ipcamera.com//system.html
|
|
|
|
This vulnerability allows an attacker to take full control of
|
|
the IP Camera.
|
|
|
|
Vendor Response:
|
|
No response received.
|
|
|
|
Remediation Steps:
|
|
No patch currently exists for this issue. To limit exposure,
|
|
network access to these devices should be limited to authorized
|
|
personnel through the use of Access Control Lists and proper
|
|
network segmentation. |