AVTECH IP camera, DVR, and NVR Devices Authenticated Root Command Execution
48Vexday Risk Score
Sem sinal de exploração. Ela tem prova de conceito pública.
ssvc Attendcvss 9.4epss 1.5%
probabilidade de exploração
1.5%top 28% das CVEs
exploração observada
nãonenhuma fonte reporta
2 exploit(s) público(s)
An OS command injection vulnerability exists in AVTECH DVR, NVR, and IP camera devices within the adcommand.cgi endpoint, which interfaces with the ActionD daemon. Authenticated users can invoke the DoShellCmd operation, passing arbitrary input via the strCmd parameter. This input is executed directly by the system shell without sanitation allowing attackers to execute commands as the root user.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Produtos afetados
AVTECH · IP camera, DVR, and NVR DevicesPoCs públicas encontradas — 2
cve_referencewww.exploit-db.com/exploits/40500não verificadocve_referenceweb.archive.org/web/20161029201749/https://github.com/ebux/AVTECHnão verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
Referências
https://avtech.com/https://vulncheck.com/advisories/avtech-ipcamera-nvr-dvr-mulitple-vulnshttps://web.archive.org/web/20161029201749/https://github.com/ebux/AVTECHhttps://web.archive.org/web/20240810225729/https://www.search-lab.hu/advisories/126-AVTech-devices-multiple-vulnerabilitieshttps://www.exploit-db.com/exploits/40500