Vulnerability identifier: #VU11198

Vulnerability risk: Low

CVSSv3.1: 6.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C]

CVE-ID: CVE-2018-7520

CWE-ID: CWE-284

Exploitation vector: Network

Exploit availability: Yes

Vulnerable software:
Geutebrück Topline TopFD-2125
Hardware solutions / Office equipment, IP-phones, print servers
Geutebrück G-Cam
Hardware solutions / Firmware

Vendor: GEUTEBRÜCK GmbH

Description
The vulnerability allows a remote attacker to download full configuration on the system.

The weakness exists due to improper access control. A remote attacker can download full configuration including passwords.

Mitigation
Update to version 1.12.0.19.

Vulnerable software versions

Geutebrück Topline TopFD-2125: 3.15.1

Geutebrück G-Cam: 1.12.0.4

---

External links
http://www.geutebrueck.com/en_EN/login.html

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.