CVE-2020-36925: falha de alta gravidade em Arteco-Global Arteco Web Client DVR/NVR
Arteco Web Client DVR/NVR Session ID Brute Force Authentication Bypass
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.7epss 0.7%
Arteco Web Client DVR/NVR contains a session hijacking vulnerability with insufficient session ID complexity that allows remote attackers to bypass authentication. Attackers can brute force session IDs within a specific numeric range to obtain valid sessions and access live camera streams without authorization.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
Arteco-Global · Arteco Web Client DVR/NVRReferências
https://cxsecurity.com/issue/WLB-2020120170https://exchange.xforce.ibmcloud.com/vulnerabilities/193750https://exchange.xforce.ibmcloud.com/vulnerabilities/194139https://packetstorm.news/files/id/160718https://www.arteco-global.comhttps://www.exploit-db.com/exploits/49348https://www.vulncheck.com/advisories/arteco-web-client-dvrnvr-session-id-brute-force-authentication-bypasshttps://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5613.php