SB2020072736 - Multiple vulnerabilities in AvertX HD838 and HD438IR cameras
Published: July 27, 2020 Updated: July 27, 2020
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 secuirty vulnerabilities.
1) Security Features (CVE-ID: CVE-2020-11623)
This vulnerability allows a local attacker to bypass security rescritions feature.
The vulnerability exists due to a weak security in AvertX IP cameras. An attacker with physical access to the UART interface can access additional diagnostic and configuration functionalities as well as the camera's bootloader.
2) Weak password requirements (CVE-ID: CVE-2020-11624)
The vulnerability allows a remote attacker to perform brute-force attack and guess the password.
The vulnerability exists due to the affected cameras do not require users to change the default password for the admin account. A remote authenticated attacker can perform a brute-force attack and disclose the default username within the login.js script.
3) Information disclosure (CVE-ID: CVE-2020-11625)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to failed web UI login attempts that elicit different responses depending on whether a user account exists. A remote attacker can enumerate legitimate usernames.
Remediation
Install update from vendor's website.